Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Centralized Ownership - mint()

nisedo

Summary

The DecentralizedStableCoin has a centralized ownership which allows the owner to mint without any restriction.

Vulnerability Details

The DecentralizedStableCoin is supposed to be decentralized. However, the deployer of the DecentralizedStableCoin.sol contract becomes the owner and thus has all the onlyOwner rights on burn() and mint().
burn() has a check to ensure the caller of the function is only burning his tokens:

uint256 balance = balanceOf(msg.sender);
if (_amount <= 0) {
//@audit-issue amount == 0 saves gas
revert DecentralizedStableCoin__MustBeMoreThanZero();
}
if (balance < _amount) {
revert DecentralizedStableCoin__BurnAmountExceedsBalance();
}

But the mint()function has no check, so the owner can mint as much as he wants without any restiction.
Therefore it isn't a decentralized stablecoin, and moreover if the owner is malicious he could act against the protocol interest.

Impact

The protocol is not decentralized.

Tools Used

Manual review

Recommendations

Make the DSCEngine.sol the owner of the DecentralizedStableCoin.sol or modify the docs to inform the users about this centralization risk.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.