Summary

There is a missing check for blacklisting in TSender::areListsValid and when we are working with USDC or USDT there might be some addresses that are blacklisted.

Vulnerability Details

When we are working with USDC and USDT because of the missing check in TSender::areListsValid the TSender::airdropERC20 function will airdrop tokens to addresses that are blacklisted and shouldn't receive anything.

Impact

The primary impact of this vulnerability is operational failure during airdrop executions. If any recipient address is blacklisted by the token contract, the entire airdrop transaction will revert, leading to failed token distribution. This can disrupt planned token distributions and undermine the reliability of the airdrop process.

Tools Used

Manual Review

Recommendations

Implement a blacklisting check in TSender::areListsValid and provide the corresponding error for it.