# Bypass the blacklist restriction because the blacklist check is not done when minting or burning

Dinari dShare blacklist check skipped on mint/burn, letting blacklisted users buy/sell via orders and cash out.

- Payout: Contest reward
- Severity: high
- Program: Dinari
- Credited: ctf_sec
- Disclosed: 2023-06-23
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-dinari-judging/issues/64
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-dinari%3AH-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** dShare ERC20 token and BuyOrderIssuer/SellOrderProcessor contracts
**Root cause:** _beforeTokenTransfer returns early when from or to is address(0), so minting and burning skip transferRestrictor.requireNotRestricted, and order flows never check blacklist on recipient/requestor.
**Steps:**
1. Blacklisted user creates buy order with payment token, setting recipient to a non-blacklisted address
2. When buy order fills, dShares are minted to the non-blacklisted recipient, bypassing blacklist
3. Before being blacklisted, user frontruns the blacklist tx to create a sell order and transfers dShares into OrderProcessor escrow
4. When sell order fills, escrowed dShares are burnt and user receives payment token
**How found:** Read whitepaper claim of OFAC/AML blacklist enforcement, then reviewed _beforeTokenTransfer and noticed the early return for address(0) skips the restriction check on mint/burn; traced order flows to confirm exploitability.
**Exploitation:** Blacklisted user routes dShare acquisition through a non-blacklisted recipient on buy orders, and pre-stages dShares in SellOrderProcessor escrow before blacklisting so the burn path pays them out in payment tokens.
**Insight:** When a token overrides _beforeTokenTransfer to skip restrictions for mint/burn, check every mint/burn call site (order fill, escrow burn) for a separate blacklist check on recipient/requestor; also check both asset and payment token restrictors.