search

hats-finance / Fenix-Finance-0x83dbe5aa378f3ce160ed084daf85f621289fb92f

0 stars 0 forks source link

User will not be able to withdraw if blacklisted for TOKEN #10

Open hats-bug-reporter[bot] opened 9 months ago

hats-bug-reporter[bot] commented 9 months ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0xa6e29c638f06f36e62f6e48be683ba1ec6b5073b6f69d239d084e909c2236840 Severity: medium

Description: Description\ In GaugeUpgradeable users can deposit and withdraw TOKEN. If TOKEN = USDC or any other token that can blacklist addresses, the user will not be able to withdraw. Add a new function with additional parameter recipient to enable withdraws for blacklisted users. The USDC will go to the recipient and the balance mapping for the msg.sender will be updated.

Attack Scenario\ Describe how the vulnerability can be exploited.

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

BohdanHrytsak commented 9 months ago

The submission mentions two problems:

  1. The submission relates to a part that is OOS
  2. Withdrawal of funds by a blocked user to a non-blocked address is also not a good way to resolve this situation. If such a situation arises, it should be resolved in the manner provided by the token