Lack of access control can leads to vault's state manipulation
Summary
The SmartVault3#burn function, lacking proper access control, allows anyone to burn EUROS, potentially manipulating the vault's health.
Vulnerability Details
SmartVault3#burn is intended to allow the vault's owner to burn a specified amount of EUROS. When this function is invoked, it modifies a critical state variable, minted, which is used to determine if the vault is sufficiently collateralized to Mint or Burn more EUROS . However, due to a lack of access control in the burn function, anyone can call burn() and burn their EUROS as long as minted >= _amount.
This vulnerability can be exploited to manipulate the vault's health by non-owners, creating confusion for the vault owner or manager about whether the vault is undercollateralized or if more EUROS can be minted.
Impact
Manipulate vault's state/status by non unauthorized callers
Tools Used
Manual
Recommendations
Consider restricting access to the burn() function by adding an onlyOwner modifier.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.