Summary
tETH and XVS present blacklisting logic that could break liquidations. XVS is also pausable, possibly leading to the same issue.
Vulnerability Detail
Liquidations in Nerite push collateral tokens to the msg.sender, from the Active Pool and to the StabilityPool.
If any of those 3 addresses is blacklisted or the collateral token is paused, liquidations that would normally work, can be DOSsed.
Impact
DoSed liquidations due to blacklisted addresses or paused tokens.
Code Snippet
For example, for XVS, it is a standard OZ ERC20 with the following alteration to _beforeTokenTransfer:
/**
* @notice Hook that is called before any transfer of tokens. This includes
* minting and burning.
* @param from_ Address of account from which tokens are to be transferred.
* @param to_ Address of the account to which tokens are to be transferred.
* @param amount_ The amount of tokens to be transferred.
* @custom:error AccountBlacklisted is thrown when either `from` or `to` address is blacklisted.
*/
function _beforeTokenTransfer(address from_, address to_, uint256 amount_) internal override whenNotPaused {
if (_blacklist[to_]) {
revert AccountBlacklisted(to_);
}
if (_blacklist[from_]) {
revert AccountBlacklisted(from_);
}
}Tool Used
Manual Review
Recommendation
These risks are not really possible to completely mitigate, unless other tokens are used.