Sparkn

Summary

If the recipient is added to the USDC blacklist, then distribute() does not work.

Vulnerability Details

when distribute function will be called by proxy contract , in which winners[] will be passed. if one of winner addrress is USDC blacklisted then in _distribute() in for loop safetransfer() will be reverted and distribution of token to winners will be stucked and fund would be passed to STADIUM_ADDRESS.

Impact

DoS of USDC distribution token system and the whole remaining funds would be transferred to 'STADIUM_ADDRESS' through _commissionTransfer(). (https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/Distributor.sol#L163)

Tools Used

Manually review

Recommendations

skip USDC blacklisted users in for loop in _distribute()