The Standard

Summary

Missing access control in theburn function of the SmartVaultV3 contract allows users who have minted EUROs tokens to call burn() on foreign SmartVaults.

Vulnerability Details

By calling burn() on a foreign SmartVault, the user would burn their own balance of EUROs but decrease the minted value for the contract they are calling the function on. This will result in wrong accounting for each Smart Vault.

Impact

Wrong accounting could lead to a loss of user funds.

Tools Used

Manual Review

Recommendations

Only allow the smart vault contract owner to call the burn() function. Add a function modifier that checks this condition.