burn Function in rUSDY.sol is Overpowered

[code423n4]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/usdy/rUSDY.sol#L672-L683

Vulnerability details

Impact

The function burn gives too much power:

function burn(
    address _account,
    uint256 _amount
  ) external onlyRole(BURNER_ROLE) {
    uint256 sharesAmount = getSharesByRUSDY(_amount);

    _burnShares(_account, sharesAmount);

    usdy.transfer(msg.sender, sharesAmount / BPS_DENOMINATOR);

    emit TokensBurnt(_account, _amount);
  }

Essentially it allows the Admin to burn shares and transfer the corresponding amount of usdy not to the contract, but to msg.sender.

This imposes a great centralization risk, especially in the event of a compromised role where the malicious actor could then drain all shares in totalSupply.

Tools Used

Manual Review, VSCode

Recommended Mitigation Steps

A few options are available:

• Complete removal of this function
• Replacing the function so that the funds are transferred to the contract instead of to msg.sender
• Implementing some sort of timelock mechanism for the whole protocol

Assessed type

Rug-Pull

[c4-pre-sort]

raymondfam marked the issue as primary issue

[c4-pre-sort]

raymondfam marked the issue as low quality report

[raymondfam]

Known issue in readme. Additionally, the sponsor has clarified in the discord channel this would only be done when users are not on the allowed list.

[c4-pre-sort]

raymondfam marked the issue as remove high or low quality report

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #85

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-judge]

kirk-baird marked the issue as grade-c

[c4-judge]

This previously downgraded issue has been upgraded by kirk-baird

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)