Submitted by DarkTower, also found by ether_sky
The bootstrap process relies on users locking up all their tokens as it will only use tokens that are marked locked in totals[MIM].locked and totals[USDB].locked.
BlastOnboardingBoot.sol#L96-L127
However, it is possible that these values can be zero because there is a cap on the amount of tokens that can be stored in the contract.
BlastOnboarding.sol#L101-L121
In the code above, notice that there is a cap on the amount of tokens that can be sent to the contract caps[token]. The problem here is that it is checked against the total token amount totals[token].total rather than the locked amount totals[token].locked.
Therefore a griefer can deposit tokens up to the caps[token] with lock_ = false. The result, is that no one else can deposit tokens into the contract.
During bootstrap, since these tokens are still considered unlocked, then  totals[MIM].locked = 0 and totals[USDB].locked = 0, therefore there wont be any locked tokens available for the bootstrapping process.
Instead of checking caps[token] against totals[token].total, it should be checked against totals[token].locked.
0xCalibur (Abracadabra) confirmed, but disagreed with severity and and commented:
cccz (Judge) decreased severity to Medium and commented:
Note: For full discussion, see here.
For this audit, 25 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by ether_sky received the top score from the judge.
The following wardens also submitted reports: Bauchibred, hals, slvDev, DarkTower, Trust, HChang26, albahaca, Breeje, Bigsam, 0xE1, 0x11singh99, grearlake, bareli, blutorque, hassan-truscova, oualidpro, Bozho, zhaojie, SpicyMeatball, 0xJaeger, ravikiranweb3, hihen, ZanyBonzy, and pfapostol.
