Summary

Users can mint DSC through the mintDsc function without providing a collateral.

Vulnerability Details

A user who has previously deposited collateral and minted DSC through the depositCollateralAndMintDsc function and is not undercollateralized can mint more DSC without providing collateral through the mintDsc function.

It is possible for such a user to do this because the mintDsc function visibility is public.

function mintDsc(uint256 amountDscToMint) public moreThanZero(amountDscToMint) nonReentrant {

Impact

What this means is that a user with good health factor (not undercollateralized) can call the mintDsc function anytime the user wants and mint DSC away without providing collateral.

Tools Used

Manual review

Recommendations

The mintDsc function's visibility should be marked internal and not public.