Tadle

Summary

The CapitalPool contract, which holds all user funds, is vulnerable to potential blacklisting by centralized tokens like USDC. If the CapitalPool address gets blacklisted, it could result in the loss of funds for all users.

Vulnerability Details

Centralized tokens like USDC have the ability to blacklist addresses, preventing them from sending or receiving tokens. The current architecture has a single CapitalPool holding all user funds. If this address were to be blacklisted:

1. Users would be unable to withdraw their USDC (or other blacklist-capable tokens).

2. The protocol would be unable to interact with the blacklisted tokens in the CapitalPool.

Impact

If the CapitalPool address is blacklisted:

1. All users' funds in the blacklisted token would become inaccessible.

2. The protocol's functionality for that token would be completely disrupted.

3. User trust in the protocol could be severely damaged.

Tools Used

Foundry

Recommendations

Do not whitelist tokens with blacklist functionality to prevent this scenario from happening.