It is possible to remove the KYC status of any user by using the removeKYCAddresses function. This could be easily overridden by user using the addKYCAddressViaSignature function as shown below
Proof of Concept
User KYC is approved and he is provided with a signature signed by an address with the role kycGroupRoles[kycRequirementGroup]
User claims his KYC approved status using addKYCAddressViaSignature function which marks him kycState[kycRequirementGroup][user] = true
One of KYC group role realizes that User KYC was not actually proper and decides to remove his KYC status using removeKYCAddresses function
This sets kycState[kycRequirementGroup][user] = false
function removeKYCAddresses(
uint256 kycRequirementGroup,
address[] calldata addresses
) external onlyRole(kycGroupRoles[kycRequirementGroup]) {
uint256 length = addresses.length;
for (uint256 i = 0; i < length; i++) {
kycState[kycRequirementGroup][addresses[i]] = false;
}
emit KYCAddressesRemoved(msg.sender, kycRequirementGroup, addresses);
}
But since the signature provided in Step 1 is still not expired so User simply recalls addKYCAddressViaSignature function to again set kycState[kycRequirementGroup][user] = true
Lines of code
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/kyc/KYCRegistry.sol#L79
Vulnerability details
Impact
It is possible to remove the KYC status of any user by using the
removeKYCAddresses
function. This could be easily overridden by user using theaddKYCAddressViaSignature
function as shown belowProof of Concept
User KYC is approved and he is provided with a signature signed by an address with the role kycGroupRoles[kycRequirementGroup]
User claims his KYC approved status using
addKYCAddressViaSignature
function which marks himkycState[kycRequirementGroup][user] = true
One of KYC group role realizes that User KYC was not actually proper and decides to remove his KYC status using
removeKYCAddresses
functionThis sets
kycState[kycRequirementGroup][user] = false
addKYCAddressViaSignature
function to again setkycState[kycRequirementGroup][user] = true
Recommended Mitigation Steps
Mark the signature as used