# Users may send tokens before the dead block period to an address to blacklist it Low/Info · Three Sigma · Modular blockchain infrastructure · 27th January 2024 Finding 3S-TR-L02 of the Trestle wTIA Bridge security review. - Report: /reports/trestle-wtia-bridge - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-01-27-trestle.pdf --- ### Description During the dead block period, before trading has started, users may send tokens to an address to maliciously blacklist it. ### Recommendation The admin can remove addresses from the blacklist, but still, the dead block approach to blacklist could be thought over. ### Status Dead block period is over. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Pausable or Blacklist tokens may cause liquidations to fail](https://0xsimao.com/findings/nerite-pausable-blacklist-liquidations-fail): Nerite - [KeyringCoreV2Base::collectFees() should use Address::sendValue() instead of address.transfer()](https://0xsimao.com/findings/keyring-ii-keyring-fees-send-transfer): Keyring Credentials - [triggerSendFrom() will send all the ETH in the destination chain where sendFrom() is called to the refundAddress in the LzCallParams argument](https://0xsimao.com/findings/tapioca-dao-eth-refund-params-argument): Tapioca DAO - [In BaseRouter, _handleSwapAction(...), users shouldn't be allowed to send funds to an allowed flasher](https://0xsimao.com/findings/fuji-finance-handle-action-shouldn-flasher): Fuji Finance