050.md

Fast Khaki Raccoon

Medium

PodUnwrapLocker::_withdraw would brick all user funds if he gets blacklisted for only 1 of the tokens

Summary

If a user gets blackliste for one of the tokens this for would revert resulting in his funds being stuck.

https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/PodUnwrapLocker.sol#L148

    function _withdraw(address _user, uint256 _lockId) internal {
        LockInfo storage _lock = locks[_lockId];
        require(_lock.user == _user, "W1");
        require(!_lock.withdrawn, "W2");
        require(block.timestamp >= _lock.unlockTime, "W3");

        _lock.withdrawn = true;

        for (uint256 i = 0; i < _lock.tokens.length; i++) {
            if (_lock.amounts[i] > 0) {
                //@audit if a user gets balcklisted for one of the tokens this reverts
                IERC20(_lock.tokens[i]).safeTransfer(_user, _lock.amounts[i]);
            }
        }

        emit TokensWithdrawn(_lockId, _user, _lock.tokens, _lock.amounts);
    }

Root Cause

Using a loop to distribute different tokens.

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

1. Bond is 10% USDT, 10% USDC 40% WETH 40% WBTC
2. User gets blacklisted for USDT
3. His bond is worth 100k
4. All of these assets would remain stuck inside the contract

Impact

All of our user assets would get stuck inside the contract if he gets blacklisted for 1 of the tokens

PoC

No response

Mitigation

User pull instead of push. Make sure the user claims his tokens 1 by 1.