All findingsCritical
Noon (USN) ·Ethereum
RedeemHandler.redeem() has no USN/collateral ratio check
Verified with working PoC
Contract: 0xcC2447B495cBc8c2263619Ff3dc4c13604c9b11f
access controlaccountingfund drain
Summary
RedeemHandler.redeem() burns order.usnAmount and pays out order.collateralAmount with no on-chain relationship enforced between the two, for any caller holding BURNER_ROLE.
Root cause
The live BURNER_ROLE + DEFAULT_ADMIN_ROLE holder on the real, currently-deployed RedeemHandler is a plain EOA that can trivially self-sign a redemption order with an arbitrary collateral amount.
Verification
PoC confirmed draining the contract's full collateral balance (both its current real balance and a simulated operational float) by burning 1 wei of USN.
Verified against real, live deployed contract state.
Receipt on GitHub