Frankencoin - HaCk0's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L313

Vulnerability details

Impact

Equity.restructureCapTable() only deletes the first entry in addressesToWipe and renders the functions core functionality useless.
Equity.restructureCapTable() would be used to burn tokens in case the Equity contract doesn't have enough funds left. But on line 313 it doesn't use the index i of the array but only always the first entry.
This bug prevents the function to doing the inteded job and each address would need to be delete with it's own transaction.

...
function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
    require(zchf.equity() < MINIMUM_EQUITY);
    checkQualified(msg.sender, helpers);
    for (uint256 i = 0; i<addressesToWipe.length; i++){
        address current = addressesToWipe[0];
        _burn(current, balanceOf(current));
    }
}
...

Recommended Mitigation Steps

Consider using addressToWipe[i] for current instead of addressToWipe[0]