Upgraded Q -> 2 from #506 [1695291399781]

[c4-judge]

Judge has assessed an item in Issue #506 as 2 risk. The relevant finding follows:

[L‑01] The admin wont be able to burn rUSDY if the address is blacklisted/sanctioned and not on the allowlist
The burn() function in rUSDY.sol allows the admin to seize rUSDY if the user is not legally allowed to own it. It will first burn the shares and then it will transfer the USDY. The problem is that the user can be blacklisted/sanctioned which will make the tx revert because of _beforeTokenTransfer(). The user also needs to be on the allowlist.

It is very likely that the user will first be blacklisted to prevent him from transferring his assets before they are seized so the admin wont be able to seize the assets because when burning _beforeTokenTransfer() checks if the address is blacklisted/sanctioned or no and reverts.

Impact
The admin wont be able to seize assets from the user and he will have to unblacklist him and maybe put him on the allowlist to do this which can be a problem because the user can quickly transfer his assets when he is not blacklisted.

[c4-judge]

kirk-baird marked the issue as duplicate of #136

[c4-judge]

kirk-baird marked the issue as satisfactory