Submission Details
Severity:
Anyone can mint as many `WStETH` as he want for free
Summary
Anyone can mint as many WStETH as he want without any collateral
Vulnerability Details
the mint() function in the WStETHMock contract allow anyone to mint as many tokens as he want as there is no modifier to protect the function and no collaterals are requested for that mint
function mint(address account_, uint256 amount_) external {
_mint(account_, amount_);
}
Impact
Mint free WStETH tokens
Tools Used
Manual audit
Recommendations
Put in place a modifier to protect access to that function to only the Owner.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Lack of access control in `StETHMock:mint` and `WStETHMock::mint`
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.