Frankencoin - zzebra83's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Equity.sol#L313

Vulnerability details

Impact

The restructureCapTable function in Equity.sol does not properly burn balances for addresses to wipe. This is because the current address variable within the loop is always assigned to the first element in the addressesToWipe list.

Due to this bug, FPS holders who bootstrap the system will not own 100% of all FPS shares.

Proof of Concept

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Equity.sol#L313

    function restructureCapTable(address[] calldata helpers, address[] calldata addressesToWipe) public {
    require(zchf.equity() < MINIMUM_EQUITY);
    checkQualified(msg.sender, helpers);
    for (uint256 i = 0; i<addressesToWipe.length; i++){
        address current = addressesToWipe[0]; # @audit: should be i instead of 0
        _burn(current, balanceOf(current));
    }
}

Recommended Mitigation Steps

address current = addressesToWipe[i];

change the 0 to i instead to fix the problem.