Submission Details
Severity:
Blacklisted `STADIUM_ADDRESS` can cause funds to be stuck in the distributor
Vulnerability Details
Several popular tokens, such as USDC, implements a blacklist, preventing the blacklist user from receiving or making transfers. If STADIUM_ADDRESS is blacklisted, then it will not be possible to distribute prizes or rescuing them, as the address is always the commission recipient.
Impact
Funds will be locked in the contract.
Tools Used
Manual review
Recommendations
Allowing changing commission address by admin, or implement a blacklist check before transferring.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.