The Standard

Summary

The SmartVault3#burn function, lacking proper access control, allows anyone to burn EUROS, potentially manipulating the vault's health.

Vulnerability Details

SmartVault3#burn is intended to allow the vault's owner to burn a specified amount of EUROS. When this function is invoked, it modifies a critical state variable, minted, which is used to determine if the vault is sufficiently collateralized to Mint or Burn more EUROS . However, due to a lack of access control in the burn function, anyone can call burn() and burn their EUROS as long as minted >= _amount.

This vulnerability can be exploited to manipulate the vault's health by non-owners, creating confusion for the vault owner or manager about whether the vault is undercollateralized or if more EUROS can be minted.

Impact

Manipulate vault's state/status by non unauthorized callers

Tools Used

Manual

Recommendations

Consider restricting access to the burn() function by adding an onlyOwner modifier.