Unauthorized Token Burning and Inconsistent Reward in burn Function

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/main/contracts/usdy/rUSDY.sol#L680

Vulnerability details

Impact

The burn function in the smart contract allows users with the BURNER_ROLE to burn any amount of tokens from any users' accounts so they recieve the tokens reward calculated as sharesAmount / BPS_DENOMINATOR.
This security issue can lead to unauthorized token burning and unauthorized token claim for burner, potentially causing financial harm and undermining trust in the contract.

Proof of Concept

function burn(
address _account,
uint256 _amount
) external onlyRole(BURNER_ROLE) {
uint256 sharesAmount = getSharesByRUSDY(_amount);

_burnShares(_account, sharesAmount);
usdy.transfer(msg.sender, sharesAmount / BPS_DENOMINATOR);

..
}

Tools Used

Manual review

Recommended Mitigation Steps

add a check to the amount possible for the burner to burn

Assessed type

Rug-Pull

[c4-pre-sort]

raymondfam marked the issue as duplicate of #85

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-judge]

kirk-baird marked the issue as grade-c

[c4-judge]

This previously downgraded issue has been upgraded by kirk-baird

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)