15,000 USDC
Submission Details
Severity:
paying with almost blacklisted tokens`repayBadDebtWithCash`
Summary
blacklisted usdt or usdc can not be used
Vulnerability Details
anyone can call repayBadDebtWithCash and transfer funds. if address is blacklisted a user or the
protocol can not use the funds
Impact
protocol can be locked
funds can be lost
Tools Used
manual
Recommendations
add access control
check for blacklisted
+ require(msg.sender == admin, "only the admin may call this function");
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
39438 USDC / LOC
14,000 USDC
1,000 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.