Ondo Finance - Delvir0's results

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/usdy/rUSDY.sol#L672-L683

Vulnerability details

Impact

The burn() function which is only able to be called by the owner is used to burn rUSDY (shares) from any account. The burn function calls _burnShares() which has the _beforeTokenTransfer() check implemented to ensure none of the actions include a non-whitelisted of restricted user. When calling burn(address _account) it's eventually passed as _beforeTokenTransfer(address _account) where it's checked.

If _account is blacklisted, the function will revert making the admin burn function unusable for that account.

Proof of Concept

All provided above

Tools Used

Manual review

Recommended Mitigation Steps

When called via the admin burn function, skip the _beforeTokenTransfer()

Assessed type

Token-Transfer