Summary

The current implementation of the stable coin uses the OZ Ownable contract to keep track of the owner of the token, which would be the engine contract in this case. As new versions of the libraries are coming out, the coin might get deployed with a newer version which would break the currently written algorithm.

Vulnerability Details

The newest version of the Ownable OZ contract, and probably future versions, now needs the initial owner to be passed as an argument, which would set the owner to the address(0) if no argument is passed, as the current stable coin constructor does.

Impact

The owner is left uninitialized, breaking the entire contract.

Tools Used

Manual Review

Recommendations

Carefully consider the version in use, provide the initial owner parameter to the Ownable constructor.