Frankencoin - deadrxsezzz's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Equity.sol#L313

Vulnerability details

Impact

restructureCapTable will always only burn the tokens of the first address in addressesToWipe. Any function that relies on restructureCapTable will malfunction.

Proof of Concept

When going through the for-loop on #L312-#L315, the current variable always gets the value of addressesToWipe[0], basically only burning its tokens rather than the tokens of all of the addresses in the array.

Tools Used

Manual review

Recommended Mitigation Steps

- address current = addressesToWipe[0];
+ address current = addressesToWipe[i];

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L263-#L266 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L380-#L383

Vulnerability details

Impact

Position owners may never be able to withdraw any collateral

Proof of Concept

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L380-#L383 Consider the following scenario: Alice mints 1000 ZCHF against a collateral worth 1500 ZCHF and sets minCollateral to 1200 ZCHF A malicious user might constantly create challenges with challenge collateral == 1300 ZCHF and instantly bid 1300 ZCHF on them. This way he assures that he will never lose any tokens on the challenge and he could make such challenges for an indefinite amount of time. Since the position owner cannot withdraw any collateral while there are ongoing challenges, his collateral becomes permanently stuck.

Tools Used

Manual review

Recommended Mitigation Steps

Add regular timeframes at which position owners cannot be challenged/ can withdraw collateral even if challenged.