Submitted by josephdara, also found by Arz, ge6a, KIntern_NA, Team_Rocket, mert_eren, sorrynotsorry, Eeyore (1, 2), tnquanghuy0512, Limbooo, 0xmystery, Yanchuan, RamenPeople, lanrebayode77, J4X, degensec, HChang26, 0xAadi, castle_chain, 0xpiken, SpicyMeatball, and Beosin
https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L225-L238
https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDe.sol#L245-L248
The StakedUSDe contract implements a method to SOFTLY or FULLY restrict user address, and either transfer to another user or burn.
However there is an underlying issue. A fully restricted address is supposed to be unable to withdraw/redeem, however this issue can be walked around via the approve mechanism.
The openzeppelin ERC4626 contract allows approved address to withdraw and redeem on behalf of another address so far there is an approval.
Blacklisted Users can explore this loophole to redeem their funds fully. This is because in the overridden _withdraw function, the token owner is not checked for restriction.
Also in the overridden _beforeTokenTransfer there is a clause added to allow burning from restricted addresses:
All these issues allows a restricted user to simply approve another address and redeem their usde.
This is a foundry test that can be run in the StakedUSDe.blacklist.t.sol in the test/foundry/staking directory.
Here we use address(56) as the second address, and we see that the user can withdraw their 100000000000000000000 tokens that was restricted.
This is my test result showing the  balances.
Foundry, Manual review
Check the token owner as well in the _withdraw function:
FJ-Riveros (Ethena) confirmed via duplicate issue #666
0xDjango (judge) decreased severity to Medium
josephdara (warden) commented:
0xDjango (judge) commented:
