Core Contracts

Summary

The Auction contract permanently assigns businessAddress as the recipient of all USDC payments. However, since USDC implements a blacklist mechanism, there is a major risk that:

1. The businessAddress could be blacklisted, making it incapable of receiving USDC.

2. The auction contract has no fallback mechanism to change businessAddress in such cases.

3. Users' USDC transfers may get stuck, causing failed transactions and an inoperable auction.

businessAddress cannot be updated if blacklisted

The contract hardcodes businessAddress as immutable, meaning it cannot be changed even if it gets blacklisted.

Impact

Since businessAddress is immutable, if it is blacklisted, the contract is permanently stuck.

Core function - buy() destroyed

Tools Used

manual

Recommendations

Instead of making businessAddress immutable, allow the owner to change it in case of blacklist issues.