USDC blacklisted account cannot be able use ClaimReward if reward token would be Usdc
Summary
If the recipient is added to the USDC blacklist, then in ClaimReward() if token reward would be UDSC then transfer does not work and Claimreward() function would revert.
Vulnerability Details
USDC blacklisted when call ClaimRewards() then ,if reward amount will be >0 then IERC20(USDCaddress).transfer will not work and rewards >0 means if transfer will not work and in starting only you are deleting the rewards "delete rewards[abi.encodePacked(msg.sender, _token.symbol)];". So user will not be able to claim rewards
Impact
Also if Someone want to DOS then if attacker will stake and then try claim rewards. and reward token would be USDC then ClaimReward() function would revert. And also you are deleting rewards for msg.sender before checking if funds is transfer or not. rewards would be deleted and user will also not get funds
Tools Used
Manual Review
Recommendations
Prevent USDC blacklisted users to stake and Claim Rewards
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.