USDC/USDT Blacklisted Attacker will lose rewards

Description

• The Attacker is basically performing an onchain penetration test and succeed. However, Circle and Tether may blacklist addresses that are involved in onchain hacks in general. Even if they have a Battlechain agreement

• This will make Attacker lose their bounty as transfer to their address fails.

Although Typically Invalid Categories in Docs contains "User self-harm through blacklisting"

This isn't self harm as Attacker is not trying to make himself blacklisted. The arrangement as a whole leads to him getting blacklisted and potentially getting stripped of his Bounty reward.

Risk

Likelihood:

• Occurs fairly often provided Circle/ Tether's offchain mechanism automatically blacklists an attacker involved in a hack

• Occurs in most tokens that have regulatory compliance to blacklist addresses involved in hacks

Impact:

• Attacker cannot get his bounty

• Agreement cannot be fulfilled

Proof of Concept

Recommended Mitigation