The Standard

Summary

no checks for burning the tokens

Vulnerability Details

there is no check for who is calling the burn() function in the SmartVaultV3.sol contract. The smartVault is meant for the usage of a single user but when there is no check in the burn() function anyone can call the burn() function.
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultV3.sol#L169

Impact

By calling the burn() function which will decrease the balance of the msg.sender but will also decrease the amount of mintted tokens of the vault while the owner of the vault has his tokens but the mintted amount will be decreased.

Tools Used

Manual Review

Recommendations

It is best to add the onlyOwner() modifier to the burn() function to avoid this behavior.