Frankencoin - volodya's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L309

Vulnerability details

Impact

Detailed description of the impact of this finding. Restructuring the system does not wipe all addresses

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. When a user wants to wipe an address while restructuring the system, only the first address will be wiped. All others will not be wiped.

    function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
        require(zchf.equity() < MINIMUM_EQUITY);
        checkQualified(msg.sender, helpers);
        for (uint256 i = 0; i<addressesToWipe.length; i++){
            address current = addressesToWipe[0]; // wipe only first address
            _burn(current, balanceOf(current));
        }
    }

contracts/Equity.sol#L309

Tools Used

Manual

Recommended Mitigation Steps

    function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
        require(zchf.equity() < MINIMUM_EQUITY);
        checkQualified(msg.sender, helpers);
        for (uint256 i = 0; i<addressesToWipe.length; i++){
-            address current = addressesToWipe[0];
+            address current = addressesToWipe[i];
            _burn(current, balanceOf(current));
        }
    }