Denial of service in AmbassadorRegistry::distributeFunds due to usdc/usdt blacklist behaviour
distributeFunds loops over ambassadors and uses require on each transfer; a single blacklisted ambassador address reverts the entire batch, blocking all rewards.
Description
The AmbassadorRegistry::distributeFunds function loops over all active ambassadors and transfers tokens using stablecoin.transfer:
require(stablecoin.transfer(ambassador, amountPerAmbassador), "Transfer failed");
If any ambassador address is blacklisted by usdt/usdc, the transfer will revert. This will cause the whole function to fail, preventing all other ambassadors from receiving their rewards.
Impact
Denial of service for reward distribution as it will affect all ambassadors that were supposed to receive rewards.
Recommendation
Rewrite the function to handle failed transfers separately so it does not revert the whole function:
bool success = stablecoin.transfer(ambassador, amountPerAmbassador);if (success) {ambassadors[ambassador].totalEarned += amountPerAmbassador;} else {emit TransferFailed(ambassador, amountPerAmbassador);}
Use a pull based system instead of a push system.
Resolution
Nexalo: Fixed.
Zealynx: Verified. Fixed.

