MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`WStETHMock::mint` is missing access control

auditism

Summary

The mint() function in the WStETHMock.sol and stETHMock.sol contract is missing proper access control, anyone can mint WStETHMock or stETHMock tokens.

Vulnerability Details

Both contracts allows anyone can mint tokens, but this action should only performed by the allowed authority such as the bridge, or through the Lido protocol.

https://github.com/Cyfrin/2024-01-Morpheus/blob/76898177fbedcbbf4b78b513d9fa151bbf3388de/contracts/mock/tokens/StETHMock.sol#L19

function mint(address _account, uint256 _amount) external {

https://github.com/Cyfrin/2024-01-Morpheus/blob/76898177fbedcbbf4b78b513d9fa151bbf3388de/contracts/mock/tokens/WStETHMock.sol#L15

function mint(address account_, uint256 amount_) external {

Impact

Severe impact as anyone can mint WStETHMock and stETHMock

Tools Used

Manual review

Recommendations

Add proper access control for the minting of the token. Only a bridge contract or the Lido protocol should be able to mint.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in `StETHMock:mint` and `WStETHMock::mint`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.