Ondo Finance - merlin's results

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/usdy/rUSDY.sol#L672

Vulnerability details

The natspec documentation for the rUSDY.burn function contains a statement that reads: Admin burn function for burning rUSDY tokens from any account, which is inaccurate.

Proof-of-Concept

This function is intended for use in situations where a user possesses USDY but is legally prohibited from owning it. If a user is blocked, sanctioned, or not on the allowlist, then an account with the BURNER_ROLE will not be able to burn the user's tokens.

Include the following mock contract and test in the Test_rUSDY to examine it:

	contract BlockListMock {
  function isBlocked(address) external pure returns (bool) {
    return true;
  }
}

function test_rUSDY_adminCannotBurnFromBlocklistedAccount()
    public
    dealAndWrapAlice
  {
    vm.startPrank(guardian);
    BlockListMock blocklistContract = new BlockListMock();
    rUSDYToken.setBlocklist(address(blocklistContract));
    assertEq(address(rUSDYToken.blocklist()), address(blocklistContract));

    vm.expectRevert("rUSDY: 'sender' address blocked");
    rUSDYToken.burn(alice, 100e18);
  }

Impact

This does not align with the documentation, and the tokens that belonged to this user will be locked. However, any other users who are on the allowlist, not blocked, or sanctioned can have their tokens burned.

Tools Used

Manual

Recommended Mitigation Steps

Please contemplate the possibility of enabling the burning of tokens exclusively from blocked or sanctioned accounts.

Assessed type

Context