Excess privilege to BURNER_ROLE to burn the rUSDY

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/usdy/rUSDY.sol#L672-L683

Vulnerability details

Impact

Valid user's shares are burnt which would be loss to them.

Proof of Concept

Since the Bot report does not explain this, we are submitting this as valid issue.

rUSDY contract has burn function which can be called by admin and burn the shares.

  function burn(
    address _account,
    uint256 _amount
  ) external onlyRole(BURNER_ROLE) {
    uint256 sharesAmount = getSharesByRUSDY(_amount);


    _burnShares(_account, sharesAmount);


    usdy.transfer(msg.sender, sharesAmount / BPS_DENOMINATOR);


    emit TokensBurnt(_account, _amount);
  }

This is not fair. This negatively affect the valid user who is not blacklisted.

As we can see, ondo has certain restriction on the users so that only who are not blocker or sanctioned can interact with contract. others are not allowed.

May be, the burn function can burn the shares of the persons who are blacklisted or blocked after they had some shares minted.

Tools Used

Manual review.

Recommended Mitigation Steps

Instead of burning shares from any account, burn the shares from the account which are blocked or blacklisted.

Assessed type

Rug-Pull

[c4-pre-sort]

raymondfam marked the issue as duplicate of #85

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-judge]

kirk-baird marked the issue as grade-c

[c4-judge]

This previously downgraded issue has been upgraded by kirk-baird

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)