Frankencoin - Jiamin's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L309-L316

Vulnerability details

Impact

In Equity.sol, restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) is called by qualified FPS shareholders to burn other users' token and to restructure the system, however, due to invalid implementation, only the first user's token will be burned.

Proof of Concept

Let's examine the function:

    function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
        require(zchf.equity() < MINIMUM_EQUITY);
        checkQualified(msg.sender, helpers);
        for (uint256 i = 0; i<addressesToWipe.length; i++){
            address current = addressesToWipe[0];
            _burn(current, balanceOf(current));
        }
    }

As we can the in the for loop, the current address is assigned with the value of the first address:

address current = addressesToWipe[0];

So only the first user's token in the address array will be burned.

Tools Used

Manual Review

Recommended Mitigation Steps

address current = addressesToWipe[i];