Closed sherlock-admin3 closed 5 months ago
2 comment(s) were left on this issue during the judging contest.
panprog commented:
invalid, nothing can be done with blacklisted user anyway, so it's correct behaviour
takarez commented:
this seem to affect the user thats initiating the transaction and not any other user.
Duplicate of #18
4b
high
In
MultiInvoker.sol::_withdraw
Blacklisted USDC addresses can lead to DOSSummary
In
MultiInvoker.sol::_withdraw
we can see the function unwraps DSU into USDC and pushes USDC amount to account without any checks on the account or any handling of revertsVulnerability Detail
The
_withdraw
function is being used in a lot of functions such as_vaultUpdate
and_update
to update state automatically for the account. As we know USDC has the blacklist functionality to prevent some addresses from performing transactions, In the case where an address is being blacklisted the transaction will always revert leading to DOS and not able to retrieve fundsImpact
This revert will affect the functionalitiy of the
_vaultUpdate
,_update
and the main function that's theinvoke
Code Snippet
_withdraw
Tool used
Manual Review
Recommendation
The current implementation uses a "push" approach where usdc is sent to the recipient during every update, which introduces additional attack surfaces that the attackers can exploit.
Consider adopting a pull method for users to claim their amount.