Skip to content

Transfer Blacklist / Freeze Backdoor

SAFE-0134 Centralization Checked automatically by the scanner
1

What goes wrong

A privileged mapping (blacklist/frozen) gates transfers, letting an admin freeze any holder's funds at will. Legitimate for some compliance tokens, but an undisclosed or ungoverned freeze switch is a rug/censorship risk that must be surfaced to users.

2

The vulnerable pattern

proof of concept — how it is exploited
// admin calls setBlacklist(victim, true)
// victim.transfer(...) now reverts forever -> funds are stuck,
// while admin retains full mobility.
3

How to fix it

the pattern that is safe
// if a freeze switch is required, put it behind a timelock + events,
// document it, and scope it as narrowly as possible.
require(!frozen[from], "frozen");
Disclose and govern any freeze/blacklist power.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0134 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs