Admin can't burn tokens of users who are not KYC'd

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/rOUSG.sol#L597-L600

Vulnerability details

There is a burn() function which allows the admin to burn rOUSG tokens from any accouunt. The problem is that the admin can't burn tokens of users who are not KYC'd.

Proof of Concept

Here is the implementation of the burn() function and _burnShares() which is called by it:
https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/rOUSG.sol#L618-L640

function burn(
    address _account,
    uint256 _amount
  ) external onlyRole(BURNER_ROLE) {
    uint256 ousgSharesAmount = getSharesByROUSG(_amount);
    if (ousgSharesAmount < OUSG_TO_ROUSG_SHARES_MULTIPLIER)
      revert UnwrapTooSmall();

    _burnShares(_account, ousgSharesAmount);

    ousg.transfer(
      msg.sender,
      ousgSharesAmount / OUSG_TO_ROUSG_SHARES_MULTIPLIER
    );
  }

https://github.com/code-423n4/2024-03-ondo-finance/blob/main/contracts/ousg/rOUSG.sol#L554-L570

function _burnShares(
    address _account,
    uint256 _sharesAmount
  ) internal whenNotPaused returns (uint256) {
    require(_account != address(0), "BURN_FROM_THE_ZERO_ADDRESS");

    _beforeTokenTransfer(_account, address(0), _sharesAmount);

    uint256 accountShares = shares[_account];
    require(_sharesAmount <= accountShares, "BURN_AMOUNT_EXCEEDS_BALANCE");

    totalShares -= _sharesAmount;

    shares[_account] = accountShares - _sharesAmount;

    return totalShares;
  }

As we can see _burnShares() calls the internal _beforeTokenTransfer() function which has the following check:

function _beforeTokenTransfer(
    address from,
    address to,
    uint256
  ) internal view {
    ...
    if (from != address(0)) {
      // If not minting
      require(_getKYCStatus(from), "rOUSG: 'from' address not KYC'd");
    }
    ...

This check prevents the admin from burning tokens from users who are not KYC'd

Impact

If the admin wants to burn the tokens of a user he has to add him back to the KYC list which would allow the user to send his tokens to another account thus preventing the burn from happening.

Recommended Mitigation Steps

Perhaps you can add a check to see if msg.sender is the admin and allow him to burn without KYC checks for the account whose tokens are being burned.

Assessed type

Invalid Validation

[c4-pre-sort]

0xRobocop marked the issue as duplicate of #237

[c4-judge]

3docSec marked the issue as satisfactory