ck - Blacklisted user may prevent certain bounty claims

[github-actions]

ck

high

Blacklisted user may prevent certain bounty claims

Summary

Blacklisted user may prevent certain bounty claims

Vulnerability Detail

If a user becomes blacklisted for the token being claimed e.g is added to the USDC blacklist and the USDC token is being claimed, they would prevent bounty claims from happening.

For example: In _claimTieredPercentageBounty there is a loop used in claiming:

        for (uint256 i = 0; i < _bounty.getTokenAddresses().length; i++) {
            uint256 volume = _bounty.claimTiered(
                _closer,
                _tier,
                _bounty.getTokenAddresses()[i]
            );

This would revert whenever a transfer is attempted to a blacklisted user.

Impact

Denial of service in certain claim functions.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/ClaimManager/Implementations/ClaimManagerV1.sol#L230-L235

Tool used

Manual Review

Recommendation

Skip blacklisted users in claim processes

[iamckn]

Escalate for 45 USDC

An issue about a blacklisted user should be unique and not grouped with malicious tokens. This is because the cause is different. Argument that it has the same effect as malicious ERC20s shouldn't be the only determinant of uniqueness.
In audits several unique issues can lead to the same effect but the root cause has to be a critical factor otherwise the developers would assume all duplicate issues are caused by the same bug and they may apply incorrect fixes. For instance the developers have suggested whitelisting tokens that will be used in the pool which wouldn't fix this issue.

Tokens such as USDC will most likely be included in the protocol and are therefore not malicious. A user who gets added to the USDC blacklist may not even be a malicious but they would still affect the protocol.

[sherlock-admin]

Escalate for 45 USDC

An issue about a blacklisted user should be unique and not grouped with malicious tokens. This is because the cause is different. Argument that it has the same effect as malicious ERC20s shouldn't be the only determinant of uniqueness.
In audits several unique issues can lead to the same effect but the root cause has to be a critical factor otherwise the developers would assume all duplicate issues are caused by the same bug and they may apply incorrect fixes. For instance the developers have suggested whitelisting tokens that will be used in the pool which wouldn't fix this issue.

Tokens such as USDC will most likely be included in the protocol and are therefore not malicious. A user who gets added to the USDC blacklist may not even be a malicious but they would still affect the protocol.

You've created a valid escalation for 45 USDC!

To remove the escalation from consideration: Delete your comment.
To change the amount you've staked on this escalation: Edit your comment (do not create a new comment).

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[Evert0x]

Escalation accepted.

An issue about a blacklisted user should be unique and not grouped with malicious token.

Correct. but this only blocks the one user that's blacklisted, it doesn't affect other users in the protocol. In the extremely unlikely case they got blacklisted they could just re-associate their ID with a different address to get the payout.

Closing issue as it's not a valid medium or high.

[sherlock-admin]

Escalation accepted.

An issue about a blacklisted user should be unique and not grouped with malicious token.

Correct. but this only blocks the one user that's blacklisted, it doesn't affect other users in the protocol. In the extremely unlikely case they got blacklisted they could just re-associate their ID with a different address to get the payout.

Closing issue as it's not a valid medium or high.

This issue's escalations have been accepted!

Contestants' payouts and scores will be updated according to the changes made on this issue.