search

hats-finance / Blast-Futures-Exchange-0x97895c329b950755566ddcdad3395caaea395074

0 stars 0 forks source link

Block-list ERC20s would lead to unwanted functionality #9

Open hats-bug-reporter[bot] opened 10 months ago

hats-bug-reporter[bot] commented 10 months ago

Github username: @PlamenTSV Twitter username: @p_tsanev Submission hash (on-chain): 0x5886ea0bd151fb54e00723243d790f7b019fdc275160256220bcf43bbc0589a3 Severity: high

Description: Description\ Popular tokens like USDC and USDT which are surely to be used here, as well as other stable coins, tend to contain blacklist/blocklist functionality, disallowing certain addresses from initiating transfers. If a user with a deposit gets blocked, he can never recover his funds.

Attack Scenario\ User A deposits, he gets block-listed. Thus any attempt to withdraw would fail. That is because even though you give him the ability to define a trader address to receive the tokens, that trader address is a part of the signature. Meaning that if a block-listed user tries to provide a non-blocklisted address to receive his tokens, his signature would fail and the tokens would remain stuck.

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

    Recommendation: do not include the trader address into the digest. Instead include the address of the staker and check against it. This way a staker can have a valid signature and still provide an arbitrary address to receive his funds if he is blocked.

bahurum commented 9 months ago

If a blocklisted trader cannot recover the tokens to its address, than that is fine as that is how the blocklist works.