Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`DecentralizedStableCoin` does not override `burnFrom`, leaving the original function callable by anybody

abarbatei

Summary

Anyone can call DecentralizedStableCoin::burnFrom as it is not gated by onlyOwner.

Vulnerability Details

DecentralizedStableCoin does not override burnFrom this means that anyone can call the original ERC20Burnable:burnFrom function which it inherits.

Impact

Burning (and minting) must be done only by the project core functionality, the DSCEngine and it to be done only when collateral is removed or added in order to maintain a calculated, known ballance of collateral vs minted and for internal accounting purposes. Allowing burning by anyone is a severe protocol issue.

Tools Used

Manual review

Recommend Mitigation

Override the burnFrom function from ERC20Burnable and add the onlyOwner modifier (plus amount != 0 check) or simply revert on call since it burnFrom is not used in DSCEngine

function burnFrom(address account, uint256 amount) public override onlyOwner {
if (_amount != 0) {
revert DecentralizedStableCoin__MustBeMoreThanZero();
}
super.burnFrom(account, amount);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.