Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Admin Token burn manipulation in `burnBatchMultiple()`

viquetoh

Summary:

An admin can manipulate profit distributions by selectively burning other holders' tokens while maintaining their own, thereby increasing their share of profits.

Vulnerability Details:

https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/dao/tokens/MembershipERC1155.sol

function burnBatch(address from) public onlyRole(OWP_FACTORY_ROLE) {
for (uint256 i = 0; i < 7; ++i) {
uint256 amount = balanceOf(from, i);
if (amount > 0) {
burn_(from, i, amount);
}
}
}
​
1. Admin sees large coming profit distribution
​
2. Admin burn tokens from other holders keeping their own.
​

Impact:

  1. break governance trust.

  2. Direct financial loss to token holders

Tools Used:

Manual review

Recommendations:

  1. The admin should not have capability to burn holders' token

  2. Implement burn approval system.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.