Submitted by throttle
DoS of USDC withdrawal system
Currently, withdrawals are queued in an array and processed sequentially in a for loop.
However, a safeTransfer() to USDC blacklisted user will fail. It will also brick the withdrawal system because the blacklisted user is never cleared.
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L53-L67
Possible solutions:
1st solution:
Implement 2-step withdrawals:
- In a for loop, increase the users amount that can be safely withdrawn.
- A user himself withdraws his balance
2nd solution:
Skip blacklisted users in a processWithdrawals loop
atvanguard (Hubble) confirmed
moose-code (judge) commented:
