Summary

Note that burn() functions, especially does that've been prefixed as onlyOwner accessible function are mostly used to burn tokens of users and not only restricted to owner, where as this is also a centralization issue, this is common practice
However the current implementation of the burn() function has a balance check of msg.sender to ensure that the amount that's to be burnt is less than this balance, where as that's a correct move, this would only ever function for the owner

Vulnerability Details

See Summary, additionally take a look at the burn() function

Impact

Incomplete functionality I beleive, since the widely implementation is thar owner provides the respective user address.

Tools Used

Manual Audit

Recommend Mitigation

The burn() implementation should be rethought and a fix should be made if necessary.