Lack of access control
Summary
There are some functions which have no access control.
Vulnerability Details
Anyone can call the functions WStETHMock::mint, StETHMOCK::mint and StETHMOCK::transferSharesFrom.
Impact
Anyone can call the mint functions in WStETHMOCK and StETHMOCK contracts. The mint function allows the caller to mint new shares to any account. Although there is a limit on the amount per mint, there is no cap on the total number of mints, which could lead to an excessive increase in supply and potential devaluation of the token.
Also, anyone can call the StETHMOCK::transferSharesFrom with arbitrary address for sender and recipient.
The mock contracts are in scope and will be used in production, therefore it is crucial to be secured.
Tools Used
Manual Review
Recommendations
Add access control to the functions WStETHMock::mint, StETHMOCK::mint and StETHMOCK::transferSharesFrom.
Lead Judging Commences
Lack of access control in `StETHMock:mint` and `WStETHMock::mint`
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.