OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Blacklisted user cannot buy Orders

vceb

USDC offers a blacklisting functionality. If the msg.sender or the seller is blacklisted, the OrderBook::buyOrder will revert as they cannot receive USDC

Description

If the seller or the msg.sender have been blacklisted on USDC, they cannot send or receive tokens and this will break one of the core functionalities of the protocol

@> iUSDC.safeTransferFrom(msg.sender, address(this), protocolFee);
@> iUSDC.safeTransferFrom(msg.sender, order.seller, sellerReceives);

Risk

Likelihood:

This vulnerability can happen if the msg.sender of the seller have been blacklisted

Impact:

One of the core functionalities of the protocol will break, since the OrderBook::buyOrder will revert when trying to send tokens to blacklisted users

Recommended Mitigation

Consider implementing pull over push principle. Try to store the amount of tokens to be received by the seller in a mapping and provide a function for the seller to claim his/her tokens when it is removed from the blacklist

Updates

Lead Judging Commences

yeahchibyke Lead Judge
about 1 month ago
yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.