Protocol wont work with tokens that can block or prevent transfers e.g Pausable, Blacklist, Blocking etc

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/PoolManager.sol#L128
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/PoolManager.sol#L132
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L136
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L291
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/UserEscrow.sol#L32
https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/UserEscrow.sol#L48

Vulnerability details

Impact

There are various tokens and token standards that can result in transfers being stopped, blocked, blacklisted, paused or disallowed. This entails protocols may function well with these tokens up until a time when any of above measures activated leading to inability to perform transfers into and out of the protocol

Proof of Concept

Tokens such as ERC20Pausable, Pausable Tokens like WBTC, ERC1400, Polymath like tokens,

USDC has Circle which can block certain addresses; it implies all instances mentioned in the few above links and many others not mentioned with token transfers where tokens can be in described category e.g USDC results in those function parts not being able to perform transfers if block activated on the tokens.

Tether can also blacklist address of users, contracts, protocol etc leading to inability to transfer to and from USDT stablecoin

128      function transfer(address currencyAddress, bytes32 recipient, uint128 amount) public {
129          uint128 currency = currencyAddressToId[currencyAddress];
130          require(currency != 0, "PoolManager/unknown-currency");
131  
132          SafeTransferLib.safeTransferFrom(currencyAddress, msg.sender, address(escrow), amount);
133          gateway.transfer(currency, msg.sender, recipient, amount);
134:     }

Tools Used

Manual Analysis

Recommended Mitigation Steps

It is recommended such tokens be disallowed from being used with the protocol
Consider a whitelist of allowed tokens that excludes such tokens
Consider a policy to use the pause and unpause functionality if the tokens activate their blocking capabilities in instances that are detrimental to the protocol

Assessed type

Token-Transfer

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #32

[c4-judge]

gzeon-c4 changed the severity to QA (Quality Assurance)