User can be added back to KYCed list after being removed using removeKYCAddresses

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/kyc/KYCRegistry.sol#L79-L112
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/kyc/KYCRegistry.sol#L175

Vulnerability details

Impact

A user that should be removed from the KYC list can be added back to the KYCed list using addKYCAddressViaSignature() until the signature expires.

Proof of Concept

• User submits KYC documents and gets a valid signature
• User submits the signature to get whitelisted using addKYCAddressViaSignature()
• Team revokes KYC using removeKYCAddresses
• User resubmits signature using addKYCAddressViaSignature(), the address will be added back to the whitelist

Tools Used

Manual review

Recommended Mitigation Steps

I recommend adding a storing and checking for used signatures to prevent them from being reused. It's also lacking a mechanism to revoke not used signatures.

[trust1995]

Very short but good enough since covered the key details and fix would work although not ideal.

[c4-judge]

trust1995 marked the issue as duplicate of #187

[c4-judge]

trust1995 marked the issue as satisfactory

[c4-judge]

trust1995 marked the issue as partial-50