Submission Details
Severity:
Anyone can burn their tokens, locking collateral in contract
Summary
Anyone can burn their tokens, locking collateral in contract
Vulnerability Details
DecentralizedStableCoin.sol has two onlyOwner functions, burn and mint and only DSCEngine should be able to burn and mint new tokens.
However ERC20Burnable has another function, burnFrom which can be used to burn tokens by any account.
PoC
function testNoOtherAccountCanBurnTokensUsingBurnFrom() public {
// Alice has two accounts
address ALICE = address(1337);
address ALICE2 = address(1338);
vm.prank(dsc.owner());
dsc.mint(ALICE, 100);
// Alice approves her second account
vm.prank(ALICE);
dsc.approve(ALICE2, 1);
// Alice should not be able to use her second account to burn her tokens
vm.prank(ALICE2);
vm.expectRevert();
dsc.burnFrom(ALICE, 1);
}
Impact
Any account can burn tokens from approved addresses, locking collateral in the contract and breaking the assumption of DSCEngine being the only burner of tokens.
Tools Used
Manuel review
Recommendations
Override burnFrom() from ERC20Burnable or don’t use ERC20Burnable and use ERC20 directly instead.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.