First Flight #3: Thunder Loan

Summary

A blocklisted address can result in unforeseen errors.

Vulnerability Details

https://github.com/d-xo/weird-erc20#tokens-with-blocklists

Certain tokens, such as USDC and USDT, feature a contract-level admin-controlled address blacklist. When an address is blacklisted, all transfers to and from that address are prohibited.

In the event that a user invokes functions like deposit, redeem, or flashloan, the transactions will fail if the user's address is on the blacklist. If a user deposits tokens and their address is subsequently added to the blacklist, the funds will become permanently locked within the asset contract.

Impact

deposit,redeem,flashloan etc

Tools Used

Manual Review

Recommendations

Ensure that the receiver is not blacklisted when depositing or withdrawing tokens. Alternatively, implement an expiry check. If the receiver fails to claim the funds after the specified expiry period, allow a special account to burn their asset tokens in exchange for the funds.