Bypass the blacklist restriction because the blacklist check is not done when minting or burning
Bypass the blacklist restriction because the blacklist check is not done when minting or burning\\nIn the whitepaper:\\nthe protocol emphasis that they implement a blacklist feature for enforcing OFAC, AML and other account security requirements A blacklisted will not able to send or receive tokens\\nthe protocol want to use the whitelist feature to be compliant to not let the blacklisted address send or receive dSahres\\nFor this reason, before token transfer, the protocol check if address from or address to is blacklisted and the blacklisted address can still create buy order or sell order\\n```\\n   function _beforeTokenTransfer(address from, address to, uint256) internal virtual override {\\n        // Restrictions ignored for minting and burning\\n        // If transferRestrictor is not set, no restrictions are applied\\n\\n        // @audit\\n        // why don't you not apply mint and burn in blacklist?\\n        if (from == address(0) || to == address(0) || address(transferRestrictor) == address(0)) {\\n            return;\\n        }\\n\\n        // Check transfer restrictions\\n        transferRestrictor.requireNotRestricted(from, to);\\n    }\\n```\\n\\nthis is calling\\n```\\nfunction requireNotRestricted(address from, address to) external view virtual {\\n // Check if either account is restricted\\n if (blacklist[from] || blacklist[to]) {\\n  revert AccountRestricted();\\n }\\n // Otherwise, do nothing\\n}\\n```\\n\\nbut as we can see, when the dShare token is burned or minted, the blacklist does not apply to address(to)\\nthis allows the blacklisted receiver to bypass the blacklist restriction and still send and receive dShares and cash out their dShares\\nbecause the minting dShares is not blacklisted\\na blacklisted user create a buy order with payment token and set the order receiver to a non-blacklisted address\\nthen later when the buy order is filled, the new dShares is transferred and minted to an not-blacklisted address\\nbecause the burning dShares is not blacklisted\\nbefore the user is blacklisted, a user can frontrun the blacklist transaction to create a sell order and transfer the dShares into the OrderProcessor\\nthen later when the sell order is filled, the dShares in burnt from the SellOrderProcess escrow are burnt and the user can receive the payment token
Issue Bypass the blacklist restriction because the blacklist check is not done when minting or burning\\nimplement proper check when burning and minting of the dShares to not let user game the blacklist system, checking if the receiver of the dShares is blacklisted when minting, before filling sell order and burn the dShares, check if the requestor of the sell order is blacklisted\\ndo not let blacklisted address create buy order and sell order
Bypass the blacklist restriction because the blacklist check is not done when minting or burning
```\\n   function _beforeTokenTransfer(address from, address to, uint256) internal virtual override {\\n        // Restrictions ignored for minting and burning\\n        // If transferRestrictor is not set, no restrictions are applied\\n\\n        // @audit\\n        // why don't you not apply mint and burn in blacklist?\\n        if (from == address(0) || to == address(0) || address(transferRestrictor) == address(0)) {\\n            return;\\n        }\\n\\n        // Check transfer restrictions\\n        transferRestrictor.requireNotRestricted(from, to);\\n    }\\n```\\n