Submission Details
Severity:
Privilege Escalation in Mint/Burn
Summary
The mint and burnFrom functions allow the diamond contract full privilege.
Vulnerability Details
The onlyDiamond modifier gives the diamond contract total control to mint/burn tokens arbitrarily.
A compromise of the diamond could allow an attacker to gain these privileges.
Impact
Attacker could mint unlimited tokens if the diamond is compromised.
Tools Used
Manual
Recommendations
Separate minting/burning to another contract
Use a multisig wallet instead of single diamond address
Add mint/burn caps
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.