Blocklist

You should know how extcodesize check works to pass this challenge.

The problem is extcodesize. You cannot rely on it when checking ‘Is this a contract?’. In the first case, a hacker can bypass it through the contact constructor, and in a more complex case - play with create2 and selfdestruct(). That is, the check is quite easy to bypass.