Summary

Anyone can burn his tokens or someone's else tokens.

Vulnerability Detail

in DecentralizedStableCoin.sol the burn function using onlyOwner which means the protocol wants only the owner
to burn tokens, but ERC20Burnable.sol has burn and burnFrom, so the user can burn his or someone's else tokens.

1. user1 approve user2 to spend X amount could be any amount

2. user2 calls burnFrom to burn all user1 tokens.

Impact

users tokens could be lost and collateral froze in the DSCEngine

Code Snippet

burnFrom

Tool used

Manual Review

Recommendation

overide burnFrom and use onlyOwner modifier.
function burnFrom(address account, uint256 amount) public override onlyOwner {}