First Flight #3: Thunder Loan

Summary

Blocklist and blacklist tokens may cause unexpected behaviors

Vulnerability Details

Tokens like USDC and USDT having blocklist and or blacklist capabilities. This implies users of the protocol itself may be blocked from moving or transferring tokens

Impact

If protocol addresses e.g assetToken is blackslist or user is blacklisted transfer of these tokens from users to use the protocol or for the protocol to pay the users may not work e.g users may not be able to redeem underlying USDC or USDT if assetToken address is blacklisted

Tools Used

Manual Analysis
Weird ERC20 Tokens => https://github.com/d-xo/weird-erc20

Recommendations

Recommended to exclude these tokens via the whitelist
Recommend plausibility and emergency patterns for the protocol