# Malicious users could block liquidation or perform DOS

SecondaryRewarder pushes reward tokens during every update; a blacklisted or hook-reverting reward token makes _claimRewards revert, blocking liquidation and deposits.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: bin2chen
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/22
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-4
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** SecondaryRewarder.sol _claimRewards reward transfer
**Root cause:** Reward tokens are pushed to the account inside _claimRewards via GenericToken.safeTransferOut; if the reward token reverts (blacklist, hook, token error), the whole call reverts.
**Steps:**
1. Reward token is arbitrary ERC20 (e.g. USDC with blacklist) per scope docs.
2. Attacker gets their account blacklisted by the reward token (or uses a hook-reverting token).
3. Attacker holds an unhealthy nToken position.
4. Liquidator calls liquidation -> BalancerHandler._finalize -> Incentives.claimIncentives -> _claimRewards -> `GenericToken.safeTransferOut(REWARD_TOKEN, account, rewardToClaim)` reverts.
5. Liquidation reverts, position stays unhealthy, bad debt accrues.
**How found:** Code reading of _claimRewards push-transfer pattern combined with scope note that reward token may be arbitrary ERC20; reasoned that blacklist/hook tokens could force revert on the recipient's transfer.
**Exploitation:** Attacker intentionally makes the reward-token transfer to their own account revert (blacklist self or hook), so any liquidation path that calls _claimRewards reverts, preventing their unhealthy position from being liquidated and leaving protocol bad debt.
**Escalation:** Same revert path affects deposit, withdrawal and other functions routed through BalancerHandler._finalize, broadening the DOS surface.
**Insight:** When a protocol pushes arbitrary ERC20 rewards inside a shared finalize/accounting path, the recipient can weaponize token-level revert (blacklist, hooks) to brick any function sharing that path, including liquidation.