Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: high

Ensure `DSCEngine` is the owner of `DecentralizedStableCoin`

aak

Summary

Any address can be passed as dscAddress to DSCEngine's constructor. So there is no guarantee that dscAddress is the intended stablecoin, or if DSCEngine is the owner of dscAddress. In both these cases, the protocol won't work.

Vulnerability Details

If DSCEngine is not the owner of dscAddress, then the mint and burn calls will revert as they are guarded by onlyOwner modifier.

Impact

Protocol will break, and no one can mint or burn DSC tokens.

Tools Used

Manual review.

Recommendations

Update DSCEngine's constructor to deploy DSCEngine. This ensures that the correct contract is deployed at dscAddress and the ownership is also set correctly:

constructor(address[] memory tokenAddresses, address[] memory priceFeedAddresses) {
// USD Price Feeds
if (tokenAddresses.length != priceFeedAddresses.length) {
revert DSCEngine__TokenAddressesAndPriceFeedAddressesMustBeSameLength();
}
// For example ETH / USD, BTC / USD, MKR / USD, etc
for (uint256 i = 0; i < tokenAddresses.length; i++) {
s_priceFeeds[tokenAddresses[i]] = priceFeedAddresses[i];
s_collateralTokens.push(tokenAddresses[i]);
}
i_dsc = new DecentralizedStableCoin();
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.