The admin wont be able to burn rOUSG from sanctioned addresses because of a check in _beforeTokenTransfer

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/rOUSG.sol#L632

Vulnerability details

The rOUSG.sol contracts has a burner role which is able to burn rOUSG from any address. The burn() function will be used to seize rOUSG/OUSG when the address is not legally allowed to own it. The problem is that the user will likely be sanctioned before the rOUSG is seized to freeze the funds but because the _burnShares() function calls _beforeTokenTransfer(), the tx will revert because of the check of the from address in _beforeTokenTransfer() which will be the sanctioned address causing the check to revert.

if (from != address(0)) {
   // If not minting
   require(_getKYCStatus(from), "rOUSG: 'from' address not KYC'd");
}

Although this finding was submitted in the previous contest a big difference here is that the KYCRegistry uses a Chainalysis sanction oracle for the checks in _beforeTokenTransfer(). In the previous contest this could have been bypassed by the admin batch executing transactions but because we are now using the Chainalysis oracle we will not be able to simply remove the sanctioned address from the oracle, burn the tokens and add it again.

Impact

The admin wont be able to seize tokens from the sanctioned address because burning will always fail. The sanctioned address will be left with the tokens stuck in the wallet.

Proof of Concept

Add this to rOUSG.t.sol, as you can see burning from a sanctioned address will fail.

function testBurningROUSG() public dealAliceROUSG(1e18) {
    assertEq(rOUSGToken.balanceOf(alice), 100e18);

    vm.startPrank(OUSG_GUARDIAN);
    rOUSGToken.grantRole(rOUSGToken.BURNER_ROLE(), OUSG_GUARDIAN);

    //ALice gets added to the Chainalysis sanctions oracle
    _restrictOUSGUser(alice);

    vm.expectRevert("rOUSG: 'from' address not KYC'd");
    rOUSGToken.burn(alice,100e18);
    vm.stopPrank();
  }

Tools Used

Foundry

Recommended Mitigation Steps

Burn the tokens without the _beforeTokenTransfer() check

Assessed type

Token-Transfer

[c4-pre-sort]

0xRobocop marked the issue as duplicate of #237

[c4-judge]

3docSec marked the issue as satisfactory