The burn function in rUSDY allows the caller to benefit by transferring the burned shares to themselves rather than burning them.

[code423n4]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/usdy/rUSDY.sol#L680

Vulnerability details

Impact

The caller can burn rUSDY from any account and gain the underlying USDY shares for themselves. This could be used maliciously to steal USDY shares.It allows the caller to collect free shares at the expense of other holders, by artificially increasing the rUSDY price.

Proof of Concept

The key part is this line: https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/usdy/rUSDY.sol#L680

This transfers the burnt shares to msg.sender rather than burning them.

This allows the caller of the burn function to get free shares. For example:

• Alice has 100 rUSDY tokens, backed by 10000 shares
• Bob has the BURNER_ROLE and calls burn on Alice's account for 50 rUSDY
• This burns 5000 of Alice's shares
• But instead of being burned, the 5000 shares are transferred to Bob
• Now Bob has 5000 free shares that he did not pay for
• Alice lost 50 rUSDY tokens and 5000 shares, but the shares did not get burned, they got transferred to Bob

This exploits the rebasing mechanic of rUSDY. When shares get burned, the rUSDY price increases for remaining holders because totalSupply decreases but pooled USDY remains the same.

So this vulnerability allows the caller to collect free shares at the expense of other holders, by artificially increasing the rUSDY price.

Tools Used

Manual

Recommended Mitigation Steps

The burn function should actually burn the shares instead of transferring them or the burn() function could be changed to send the shares to an authorized share burner address instead of the caller

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as duplicate of #85

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-judge]

kirk-baird marked the issue as grade-c

[c4-judge]

This previously downgraded issue has been upgraded by kirk-baird

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)