Sparkn

Summary

Possible stuck funds if STADIUM_ADDRESS is blacklisted by the token to be distributed.

Vulnerability Details

Tokens such as USDC and USDT use blocklists to prevent certain addresses from interacting with the token contract. If the STADIUM_ADDRESS to which fees are sent is blacklisted then the distribute function would not work.

Impact

Users would send their tokens to the address of the yet to be deployed proxy then try to deploy the proxy and distribute the funds but would fail when transferring commission to the STADIUM_ADDRESS due to it being blacklisted. The funds sent to the proxy would be unrecoverable for as long as the STADIUM_ADDRESS remains blacklisted.

Tools Used

Manual

Recommendations

Consider adding functionality to change the STADIUM_ADDRESS or functionality to track unclaimed fees that could be claimed in the future.