Here’s a bug that’s hiding in plain sight...

(and it can break your whole protocol)

Security researchers know:

It’s not just the logic inside the smart contract. It’s also how tokens behave in the real world.

Take this real-world scenario:

You’re using USDC in an auction contract. When a user is outbid, the funds are returned.

But what if...

A malicious user gets themselves blacklisted by USDC?

Now the contract can’t send their USDC back. Which means it can’t process new bids. Which means... the auction is effectively frozen.

This tiny oversight can allow an attacker to win just by being unrefundable.

→ The result? Denial of Service (DoS) via token behavior.

Here’s how you find this class of bugs:

Ask: What happens if a user gets blacklisted?

If they’re the only one that’s being affected,? That’s their problem. If it affects the rest of the system? That’s a protocol bug.

Here’s a valid Medium from Plaza Finance on Sherlock which I submitted =>https://github.com/sherlock-audit/2024-12-plaza-finance-judging/issues/179

Save this tip. Repost for your fellow auditors ♻️

Happy hunting! 🕵️‍♂️