Frankencoin - Juntao's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L313

Vulnerability details

Impact

Qualified FPS holders are not able to burn multiple addresses at the a time, in order to restructure the system when there is less than 1000 ZCHF in equity left.

Proof of Concept

If there is less than 1000 ZCHF in equity left (maybe even negative), the system is at risk and we should allow qualified FPS holders to restructure the system. In Equity.sol, qualified FPS holder can call restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) to burn any user's FPS token, however, if multiple addresses are provided as arguments, this function will only burn the first address's FPS token. The culprit lies in Line 313:

address current = addressesToWipe[0];

The current will always the first address in addressesToWipe array, if there are multiple addresses in addressesToWipe, the tokens owned first address will be burnt in the first iteration, in the following iterations, the same address will be burnt will 0 amount of token again and again, other addresses won't be affected at all.

Tools Used

Manualy Review

Recommended Mitigation Steps

Change Line 313 to:

address current = addressesToWipe[i];