Submission Details
Severity:
Anyone can mint arbitrary amount of stETH and wstETH tokens
Summary
missing privilege on minting functionality
Vulnerability Details
Missing access control on mint functions allows anyone to mint arbitrary amount of token, which would lead to drain of token locked within contracts
these allows anyone to drain ETH staked with protocol or open market
https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/mock/tokens/WStETHMock.sol#L15
function mint(address account_, uint256 amount_) external {
_mint(account_, amount_);
}
https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/mock/tokens/StETHMock.sol#L19
function mint(address _account, uint256 _amount) external {
require(_amount <= 1000 * (10 ** decimals()), "StETHMock: amount is too big");
uint256 sharesAmount = getSharesByPooledEth(_amount);
_mintShares(_account, sharesAmount);
totalPooledEther += _amount;
}
Impact
Arbitrary minting would depeg and drain locked tokens
Tools Used
Manual Review
Recommendations
mint should be a privileged function
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Lack of access control in `StETHMock:mint` and `WStETHMock::mint`
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.