Frankencoin - anodaram's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L313

Vulnerability details

Impact

In Equity.restructureCapTable, there is a for loop iterating i. Inside that, it refers addressesToWipe[0]. But actually it should be addressesToWipe[i].

Proof of Concept

No meaning if the function calls _burn for the same address multiple times. I think this is just the developer's mistake.

Tools Used

VSCode

Recommended Mitigation Steps

Original:

File: Equity.sol
313:             address current = addressesToWipe[0];

Fixed:

File: Equity.sol
313:             address current = addressesToWipe[i];