Admin can't burn rOUSG tokens if account is remove from KYC list or sanctioned.

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/78779c30bebfd46e6f416b03066c55d587e8b30b/contracts/ousg/rOUSG.sol#L624

Vulnerability details

Description:
The nat spec of burn functions says that admin can burn rOUSG tokens from any account. But it is not true, cause the admin can't burn rOUSG token of user which is remove from KYC list or sanctioned.

Proof of Concept:

1. burn function: It is calling _burnShares function to burn the shares of particular address.

function burn(
    address _account,
    uint256 _amount
  ) external onlyRole(BURNER_ROLE) {
    uint256 ousgSharesAmount = getSharesByROUSG(_amount); 
    if (ousgSharesAmount < OUSG_TO_ROUSG_SHARES_MULTIPLIER)
      revert UnwrapTooSmall();

@>   _burnShares(_account, ousgSharesAmount); 
    ousg.transfer(
      msg.sender,
      ousgSharesAmount / OUSG_TO_ROUSG_SHARES_MULTIPLIER
    );
    emit Transfer(address(0), msg.sender, getROUSGByShares(ousgSharesAmount));
    emit TransferShares(_account, address(0), ousgSharesAmount);
  }

2. _burnShares function: Than it is calling _beforeTokenTransfer function to get the KYC and sanctioned status of _account.

  function _burnShares(
    address _account,
    uint256 _sharesAmount
  ) internal whenNotPaused returns (uint256) {
    require(_account != address(0), "BURN_FROM_THE_ZERO_ADDRESS");

@>   _beforeTokenTransfer(_account, address(0), _sharesAmount); //checking KYC for account

    uint256 accountShares = shares[_account];
    require(_sharesAmount <= accountShares, "BURN_AMOUNT_EXCEEDS_BALANCE");

    totalShares -= _sharesAmount; //decreasing totalShares with shares amount

    shares[_account] = accountShares - _sharesAmount;

    return totalShares; //return total shares
  }

3. _beforeTokenTransfer function: And if now the _account is sanctioned or not in KYC list than the admin can't burn the rOUSG token of _account.

function _beforeTokenTransfer(
    address from,
    address to,
    uint256
  ) internal view {
    if (from != msg.sender && to != msg.sender) { 
      require(_getKYCStatus(msg.sender), "rOUSG: 'sender' address not KYC'd"); 
    }

@>  if (from != address(0)) {
      // If not minting
      require(_getKYCStatus(from), "rOUSG: 'from' address not KYC'd"); 
    }

    if (to != address(0)) {
      // If not burning
      require(_getKYCStatus(to), "rOUSG: 'to' address not KYC'd"); 
    }
  }

Impact:
Admin can't burn rOUSG tokens from any account as nat spec of burn function states.

Recommended Mitigation:
The recommended mitigation is to burn the rOUSG token directly in burn function rather in _burnShares function.

Assessed type

Context

[c4-pre-sort]

0xRobocop marked the issue as duplicate of #237

[c4-judge]

3docSec marked the issue as satisfactory