Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

DecentralizedStableCoin.sol has a unprotected public burnFrom method.

Vulnerability Details

DecentralizedStableCoin.sol inherits from ERC20Burnable which adds two public methods to the contract:

1. burn -> this is overridden and protected by the onlyOwner modifier

2. burnFrom -> this is not overridden and unprotected i.e. a public method

Impact

This will allow users who have a certain amount of approved tokens to burn those tokens. This means external users(other than the expected DSCEngine.sol) have the capability to change the supply of the DecentralizedStableCoin.sol without going through DSCEngine.sol

This also means that the DSCEngine.sol might be accounting having supply against an address on s_DSCMinted which doesn't even exist anymore. DSCEngine.sol will still expect collateral against supply which might not exist to maintain health factor.

Tools Used

Recommendations

I recommend overriding the burnFrom method and adding the onlyOwner modifier on it. Or inherit from a custom version of ERC20Burnable which doesn't have the burnFrom method in the first place.