Summary

The mint() function can be called by any external user, allowing anyone to mint new shares.

Vulnerability Details

The critical issue is that the mint function is defined with the external visibility modifier. This means any user can call the function and mint new shares.

There is no authentication check or onlyAuthorized modifier to restrict access.

This is a major access control vulnerability since minting new shares should only be done by an authorized party, not any user.

Note: the same issue is also in the mint function of WStETHMock contract.

Impact

Anyone can mint shares

Tools Used

Manual review

Recommendations

Access control should be implemented.