The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

If a vault gets blacklisted by any collateral token a DoS of the liquidation process occurs

cosine

Summary

The protocol stated out in discord that they want to know about any potential issue with ERC-20 tokens that could be added to the system in the future.

If a token with blacklist is used like for example USDC it could happen that USDC tries to freeze all funds of a user and therefore also the funds inside a standard vault. This will disable the liquidation process of not only USDC, but of all tokens inside the vault.

Vulnerability Details

Here we can see the liquidate function inside the SmartVaultV3 contract and how it loops over all accepted tokens and tries to transfer them to the vault manager:

function liquidateERC20(IERC20 _token) private {
if (_token.balanceOf(address(this)) != 0) _token.safeTransfer(ISmartVaultManagerV3(manager).protocol(), _token.balanceOf(address(this)));
}
​
function liquidate() external onlyVaultManager {
require(undercollateralised(), "err-not-liquidatable");
liquidated = true;
minted = 0;
liquidateNative();
ITokenManager.Token[] memory tokens = getTokenManager().getAcceptedTokens();
for (uint256 i = 0; i < tokens.length; i++) {
if (tokens[i].symbol != NATIVE) liquidateERC20(IERC20(tokens[i].addr));
}
}

If any of these tokens blacklisted the user, the whole liquidation process will revert and the vault will not be liquidated.

Impact

DoS of the liquidation process for an uncertain amount of time.

Recommendations

Implement a more flexible way to be able to also liquidate specific tokens instead of the whole vault.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

blacklist-dos

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

blacklist-dos

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.