dvyneEth - TRANSFER TO BLACKLISTED USER

[sherlock-admin4]

dvyneEth

high

TRANSFER TO BLACKLISTED USER

Summary

Transfer of token to a blocklisted user

Vulnerability Detail

The withdrawToken function in ManageableVault.sol which is called by a vault admin allows the transfer of token to blocklisted accounts

Impact

Code Snippet

https://github.com/sherlock-audit/2024-05-midas/blob/main/midas-contracts/contracts/abstract/ManageableVault.sol#L92-L100

Tool used

Manual Review

Recommendation

check if the withdrawTo is blocklisted

function withdrawToken(
        address token,
        uint256 amount,
        address withdrawTo
    ) external onlyVaultAdmin {
        onlyNotBlacklisted(withdrawTo);

        IERC20(token).safeTransfer(withdrawTo, amount);

        emit WithdrawToken(msg.sender, token, withdrawTo, amount);