All findings

Noon (USN) ·Ethereum

RedeemHandler.redeem() has no USN/collateral ratio check

Critical

Verified with working PoC

Contract: 0xcC2447B495cBc8c2263619Ff3dc4c13604c9b11f

access controlaccountingfund drain

Summary

RedeemHandler.redeem() burns order.usnAmount and pays out order.collateralAmount with no on-chain relationship enforced between the two, for any caller holding BURNER_ROLE.

Root cause

The live BURNER_ROLE + DEFAULT_ADMIN_ROLE holder on the real, currently-deployed RedeemHandler is a plain EOA that can trivially self-sign a redemption order with an arbitrary collateral amount.

Verification

PoC confirmed draining the contract's full collateral balance (both its current real balance and a simulated operational float) by burning 1 wei of USN.

Verified against real, live deployed contract state.

Receipt on GitHub