Summary

The function should be modified to only allow the onBehalfOf address to call the function. This will be done by replacing dscFrom with msg.sender in the transferFrom function. So that only owner of the tokens can initiate the burn.

Vulnerability Details

In DSCEngine.sol =>
bool success = i_dsc.transferFrom(dscFrom, address(this), amountDscToBurn) must be changed to bool success = i_dsc.transferFrom(msg.sender, address(this), amountDscToBurn)

Impact

This is because the dscFrom address is specified arbitrarily, which may allow users to move funds that do not belong to them. This could result in unauthorized access to funds and a potential loss of assets for the owner of the funds.

Tools Used

Olympix

Recommendations