Submission Details
Severity:
`PerpVault::_cancelFlow` function may revert due to USDC blacklist
Summary
This is due to the following transfer that is made in the _cancelFlow function:
function _cancelFlow() internal {
if (flow == FLOW.DEPOSIT) {
uint256 depositId = counter;
@> collateralToken.safeTransfer(
depositInfo[depositId].owner,
depositInfo[depositId].amount
);
Vulnerability Details
This will DoS the _cancelFlow functionality leading to keeper not being able to cancel the flow
Impact
keeper won't be able to cancel the flow
Tools Used
Manual Review
Recommendations
Try transferring the funds to some other contract that a user can claim them from
Updates
Lead Judging Commences
n0kto 3 months ago
Submission Judgement Published Assigned finding tags:
finding_cancelFlow_blacklisted
Likelihood: Extremely Low, when user is blacklisted between the deposit/withdraw and cancelFlow is called by the Keeper. Impact: Medium/High, cancelFlow DoS.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026 USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.