Submission Details
Severity:
Lack of access control .
Summary
Lack of access control in StETHMock::mint() , WStETHMock::mint() functions.
Vulnerability Details
function mint(address _account, uint256 _amount) external {
require(_amount <= 1000 * (10 ** decimals()), "StETHMock: amount is too big");
uint256 sharesAmount = getSharesByPooledEth(_amount);
_mintShares(_account, sharesAmount);
totalPooledEther += _amount;
}
There is no way to stop anyone from minting tokens for free using the StETHMock::mint() , WStETHMock::mint() functions.
Impact
Anyone can mint any amount of tokens for free.
Tools Used
VS code
Recommendations
Add access control checks on theStETHMock::mint() , WStETHMock::mint() functions.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Lack of access control in `StETHMock:mint` and `WStETHMock::mint`
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.