# USDC Blacklisting Prevents Trader Liquidation Crit/High · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-M10 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description USDC incorporates a blacklist functionality that reverts any attempt to transfer funds to a blacklisted address, even if the transfer amount is 0. Consequently, during a liquidation, the transfer on [L495](https://github.com/0xOstium/smart-contracts-threeSigma/blob/869392c4c9114ad468f6c2ea7e425269faf2fe2b/src/OstiumTradingCallbacks.sol#L495) within OstiumTradingCallbacks will revert, preventing the liquidation from proceeding and resulting in bad debt for the protocol. Likewise, other functions such as OstiumTrading::cancelOpenLimitOrder(), OstiumTrading::openTradeMarketTimeout(), and OstiumTradingCallbacks::openTradeMarketCallback() will also revert upon transferring the collateral back to the trader. A Proof of Concept is available [here](https://github.com/0xOstium/smart-contracts-threeSigma/blob/869392c4c9114ad468f6c2ea7e425269faf2fe2b/test/foundry/OstiumTradingCallback.t.sol#L1642). ### Recommendation To address this issue, we suggest one or more of the following solutions: - Blacklist Check During Borrowing: Implement a check for USDC blacklisting during the loan initiation process to prevent blacklisted users from opening a loan position until their status is resolved. However, this is not a complete solution, as a user's blacklist status may change between the initiation of a trade and its liquidation. - Alter Liquidation Flow: Eliminate the transfer of remaining USDC tokens to the liquidated user during the liquidation process. Instead, adopt a pull-over-push method, enabling users to withdraw their remaining USDC tokens independently after the liquidation process is complete. ### Status Addressed in [#6afda46](https://github.com/0xOstium/smart-contracts-threeSigma/commit/6afda46ed26e78304219a6d708eb70ffcfe6e765#diff-13ff36077b19b861d38a5530699623d15346a9ffae5dd235bc2e2f8bb6542d98R488-R495).