Avci - addBlackList() function doesn't check evilUser is already blacklisted

[sherlock-admin]

Avci

medium

addBlackList() function doesn't check evilUser is already blacklisted

Summary

addBlackList() function doesn't check evilUser is already blacklisted

Vulnerability Detail

If Guardian blacklists many addresses in the long term, not checking can lead to duplicate blacklisting and wasting time.

Impact

By not checking if the user is already blacklisted, the function may update the "isBlackListed" mapping unnecessarily. This can lead to inefficient resource usage, as the function performs an operation that has no effect on the state of the contract.

Code Snippet

solidity

function addBlackList(address evilUser) public onlyGuardian {
        require(evilUser != address(0), "Invalid address");
        isBlackListed[evilUser] = true;
        emit AddedBlackList(evilUser);
    }

https://github.com/sherlock-audit/2023-04-unitasprotocol-0xdanial/blob/d59a82993940aa3ef72593a75925d8600eb3514b/Unitas-Protocol/src/ERC20Token.sol#L259-L263

Tool used

Manual Review

Recommendation

it is recommended to modify the addBlackList function as follows:

function addBlackList(address evilUser) public onlyGuardian {
    require(evilUser != address(0), "Invalid address");

    if (!isBlackListed[evilUser]) {
        isBlackListed[evilUser] = true;
        emit AddedBlackList(evilUser);
    }
}