When a contract does not verify whether an account has opted in to an asset and attempts to transfer that asset, an attacker can DoS other users if the contract's operation is to transfer asset to multiple accounts.
A user must explicitly opt-in to receive any particular Algorand Standard Asset(ASAs). A user may also opt out of an ASA. A transaction will fail if it attempts to transfer tokens to an account that didn’t opt in to that asset. This could be leveraged by attackers to DOS a contract if the contract’s operation depends on successful transfer of an asset to the attacker owned address.
Contract attempts to transfer assets to multiple users. One user is not opted in to the asset. The transfer operation fails for all users.
def split_and_withdraw_asset( amount_1, receiver_1, amount_2, receiver_2, lock_expire_round, ): return And( Gtxn.type_enum() == TxnType.AssetTransfer, Gtxn.asset_receiver() == receiver_1, Gtxn.asset_amount() == amount_1, Gtxn.type_enum() == TxnType.AssetTransfer, Gtxn.receiver() == receiver_2, Gtxn.amount() == amount_2, Gtxn.first_valid == lock_expire_round, )
Use pull over push pattern for transferring assets to users.