Sparkn

Summary

With the current implementation of the Distributor::distribute function, if one of the IERC20::safeTransfer calls within it fails, the whole transaction will revert. This can become a huge problem if one of the addresses the we call safeTransfer to becomes blacklisted.

Vulnerability Details

As we know, most ERC20 tokens implement some sort of blacklisting functionality. With this in mind, if we consider the scenario where one of the addresses that we are going to try and make a transfer to in the distribute function becomes blacklisted, the whole transaction is going to revert. Taking this one step further, if the STADIUM_ADDRESS becomes blacklisted, all of the ERC20 assets of the given type will be locked forever. This is due to the fact, that the STADIUM_ADDRESS is immutable, and cannot be changed once the Distributor contract is deployed.

Impact

Funds will be stuck within the Distributor contract forever.

Tools Used

Manual review

Recommendations

Implement a pull mechanism for the withdraw functionality.