Frankencoin - Mukund's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Equity.sol#L309-L318

Vulnerability details

Impact

function won't work correctly and will not be able to burn all addressesToWipe it will only burn 0 index.

Proof of Concept

in function restructureCapTable for loop is meant to loop through addressesToWipe but failed to do so it should be i instead of 0, only the 0 index will burn .

    function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
        require(zchf.equity() < MINIMUM_EQUITY);
        checkQualified(msg.sender, helpers);
        for (uint256 i = 0; i<addressesToWipe.length; i++){
            address current = addressesToWipe[0]; //@audit should be i instead of 0
            _burn(current, balanceOf(current));
        }
    }

Tools Used

vs code

Recommended Mitigation Steps

should use i instead of 0 address current = addressesToWipe[i]