Omniscia Nexera Audit

ERC20WhitelistGatedUpgradeable Manual Review Findings

ERC20WhitelistGatedUpgradeable Manual Review Findings

ERC-01M: Inexistent Restriction of Burn Capability

Description:

The ERC20WhitelistGatedUpgradeable contract implementation fails to restrict burn capabilities through the ERC20BurnableUpgradeable dependency, thereby causing burn operations to be unrestricted.

Impact:

Users will continue to be able to burn their tokens without any authorization despite what the contract's documentation implies.

Example:

contracts/ERC20WhitelistGatedUpgradeable.sol
19contract ERC20WhitelistGatedUpgradeable is ERC20CappedMintablePresetUpgradeable, BaseTxAuthDataVerifier {
20 bytes32 public constant WHITELISTED_SPENDER_ROLE = keccak256("WHITELISTED_SPENDER_ROLE");
21
22 error MissingSignatureAndBlockNumber();
23
24 function init(
25 string memory name,
26 string memory symbol,
27 uint256 cap,
28 address defaultAdmin,
29 address minter,
30 address gatingSigner
31 ) public virtual initializer {
32 __ERC20CappedMintablePresetUpgradeable_init(name, symbol, cap, defaultAdmin, minter);
33 _setSigner(gatingSigner);
34 }
35
36 modifier whitelistGated() {
37 if (!hasRole(WHITELISTED_SPENDER_ROLE, _msgSender())) {
38 bytes calldata _msgData = _msgData();
39 // calldata must at least be 101 bytes
40 // i.e., function with no input args, 65 bytes for signature and 32 bytes for blockNumber
41 if (_msgData.length < 101) revert MissingSignatureAndBlockNumber();
42 _verifyTxAuthData(_msgData, _msgSender());
43 }
44 _;
45 }
46
47 /// @inheritdoc IERC20
48 function approve(address spender, uint256 amount) public override whitelistGated returns (bool) {
49 return super.approve(spender, amount);
50 }
51
52 /// @inheritdoc IERC20
53 function transfer(address to, uint256 amount) public override whitelistGated returns (bool) {
54 return super.transfer(to, amount);
55 }
56
57 /// @inheritdoc IERC20
58 function transferFrom(address from, address to, uint256 amount) public override whitelistGated returns (bool) {
59 return super.transferFrom(from, to, amount);
60 }
61}

Recommendation:

We advise the code to restrict burn operations as well, either through a specified role or via the generic ERC20WhitelistGatedUpgradeable::whitelistGated modifier.

Alleviation:

The burn capability has been properly restricted via the ERC20WhitelistGatedUpgradeable::whitelistGated modifier, alleviating this exhibit.