Frankencoin - jasonxiale's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L313

Vulnerability details

Impact

Qualified FPS holders might fail to restructure the system

Proof of Concept

As show in code Equity.restructureCapTable, within the for loop, the function burn addressesToWipe[0]'s balacne al the time because of typo

function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
    require(zchf.equity() < MINIMUM_EQUITY);
    checkQualified(msg.sender, helpers);
    for (uint256 i = 0; i<addressesToWipe.length; i++){
        address current = addressesToWipe[0]; // ** here it the typo
        _burn(current, balanceOf(current));
    }
}

Tools Used

VS

Recommended Mitigation Steps