# Netting and withdraw auction can be frozen permanently

A USDC-blacklisted address queues a CRAB withdrawal; the auction's mandatory USDC transfer to it reverts, permanently freezing netAtPrice and withdrawAuction.

- Payout: Contest reward
- Severity: high
- Program: Opyn
- Credited: joestakey
- Disclosed: 2022-11-22
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-opyn-judging/issues/219
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-opyn%3AH-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** CrabNetting.sol netAtPrice/withdrawAuction withdrawal queue
**Root cause:** Withdrawal processing loops call IERC20(usdc).transfer() without try/catch; a USDC-blacklisted recipient makes the transfer revert, and withdrawsIndex can only advance inside these same functions, so the queue head is permanently stuck.
**Steps:**
1. Obtain CRAB and transfer it to an address blacklisted by USDC.
2. Call the withdraw/queue function so a Receipt for the blacklisted address is appended to withdraws.
3. Any call to netAtPrice() or withdrawAuction() iterates the queue and reverts at `IERC20(usdc).transfer(withdraw.sender, amountToSend)`.
4. withdrawsIndex never advances; only the attacker can call dequeueCrab() to unstick, so auctions stay frozen.
**How found:** Code review of the withdrawal loop: noticed transfer() return/revert is unguarded and that withdrawsIndex is only mutated inside netAtPrice/withdrawAuction, making a single reverting recipient a permanent head-of-line block.
**Exploitation:** Attacker times the queued withdrawal to a moment when blocking the auction benefits them (e.g. unfavorable price), denying netting and withdraw auctions to all participants until they choose to dequeue.
**Insight:** When a queue's cursor only advances inside the same loop that performs external token transfers, any recipient that can force a revert (blacklist, reverting hook) becomes a permanent denial-of-service head-of-line block; check whether skip/dequeue paths exist for third parties.