# Malicious users could set allocations to a blacklist Protocol and break the rebalancing logic

Basket allocations to a blacklisted protocol make receiveProtocolAllocations revert, blocking rebalance and bricking the vault while Game.sol zeroes deltas.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: Ch_301
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/192
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-23
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:dos

**Target:** Solidity yield-optimiser vault/game contracts
**Root cause:** rebalanceBasket() does not validate allocations against the protocol blacklist, so a basket can carry a non-zero delta to a blacklisted protocol; setDeltaAllocationsInt then reverts on the blacklist require, and Game.sol has already zeroed the deltas.
**Steps:**
1. User calls `rebalanceBasket()` setting a non-zero allocation for a protocol that is on `controller.getProtocolBlacklist(vaultNumber, _protocolNum)`.
2. `game.sol` `pushAllocationsToVaults()` pushes deltas and sets `vaults[_vaultNumber].deltaAllocationProtocol[_chainId][i] = 0`.
3. Vault calls `receiveProtocolAllocations()` -> `setDeltaAllocationsInt()`, which hits `require(!controller.getProtocolBlacklist(...), "Protocol on blacklist")` and reverts.
4. `rebalance()` in Vault.sol can no longer execute; deltas already cleared in Game.sol.
**How found:** Code reading of the push flow: noticed Game.sol zeroes deltas before the vault-side blacklist check, so a revert leaves state inconsistent and unrecoverable.
**Exploitation:** Any user able to call rebalanceBasket can set a basket allocation to a blacklisted protocol; the push then reverts at the vault while Game.sol has already zeroed the delta, permanently blocking rebalance and requiring guardian intervention that also fails.
**Insight:** When a coordinator contract clears state before pushing to a consumer that can revert, look for validation gaps (like blacklist checks) that let an attacker force the consumer to revert after state is wiped.