Submission Details
Severity:
Blocklisted address can be used to lock the `_distribute()` function.
Summary
Blocklisted address can be used to lock the _distribute() function.
Vulnerability Details
The _distribute() function is designed to facilitate the fair and proportional distribution of tokens to a group of winners, based on given percentages.However,if one of the winner addresses is added to a blacklist, the _distribute() token function might get blocked.
https://github.com/d-xo/weird-erc20#tokens-with-blocklists
Some tokens (e.g. USDC, USDT) have a contract level admin controlled address blocklist. If an address is blocked, then transfers to and from that address are forbidden.
Malicious or compromised token owners can trap funds in a contract by adding the contract address to the blocklist. This could potentially be the result of regulatory action against the contract itself, against a single user of the contract (e.g. a Uniswap LP), or could also be a part of an extortion attempt against users of the blocked contract.
Impact
The _distribute() function might get blocked
Tools Used
Vscode
Recommendations
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477
USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.