Frankencoin - circlelooper's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L309-L316

Vulnerability details

Impact

When there is less than 1000 ZCHF in equity left, qualified shareholders will find it very hard to restructure the system as they cannot wipe mulitiple addresses at a time.

Proof of Concept

The system is at risk when there is less than 1000 ZCHF in equity left (maybe even negative), so qualified FPS shareholders are expected to restructure the system by burning users' tokens. This could be done by restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe):

    function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
        require(zchf.equity() < MINIMUM_EQUITY);
        checkQualified(msg.sender, helpers);
        for (uint256 i = 0; i<addressesToWipe.length; i++){
            address current = addressesToWipe[0];
            _burn(current, balanceOf(current));
        }
    }

Unfortunately, this functon is not implemented correctly, let's look at this line:

address current = addressesToWipe[0];

Even multiple addresses are provied in addressesToWipe, what the loop iteration does is only to burn the first address's token, while other addresses' token balance remains the same, it basically means that shareholders have to submit as many transactions as the address count they want to wipe, which is very hard to do.

Tools Used

Manual review

Recommended Mitigation Steps

Please consider to change the line as below so loop iteration will work as expected:

address current = addressesToWipe[0];