Root + Impact

Description

• In the normal design, the protocol assumes supported tokens are standard ERC20 assets that behave predictably during transfers, approvals, borrowing, and swaps. This ensures compatibility with Aave V3, Chainlink price feeds, and 1inch routing.

• However, USDC is an upgradeable and centrally controlled token whose issuer can pause transfers, blacklist addresses, or modify contract logic. This breaks the trust assumption that collateral and debt tokens remain freely transferable and immutable, which can cause position lock, forced liquidation, or permanent fund loss inside the leveraged position contract.

• 
  

• https://github.com/sadikbaba/Stratax-Contracts-code-hawks/blob/23975d62300af39b1a2a0543101f636f145e5410/src/Stratax.sol#L106

Risk

Likelihood:

USDC administrative actions (blacklist or pause) historically occur during regulatory enforcement or security incidents, which are realistic on mainnet environments.

The protocol holds all collateral and debt under a single contract address, making that address a single point of blacklist failure.

Impact:

• Collateral or debt transfers may revert permanently, preventing:

  • flash-loan repayment

  • position unwind

  • collateral withdrawal

• Funds inside Aave or the contract can become irrecoverably locked, leading to total loss of user funds.

Proof of Concept

Recommended Mitigation