Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of an access control mechanism the 'burn' function causing loss of tokens for individual user

firmanregar

Summary

The 'burn' function lacks an access control mechanism, potentially allowing unauthorized users to affect the token supply.

Vulnerability Details

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/usd/USDToken.sol#L20C1-L23C6

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.25;
​
import "forge-std/Test.sol";
import "../src/USDToken.sol";
​
contract USDTokenTest is Test {
USDToken token;
address owner = address(0x1);
address user = address(0x2);
address attacker = address(0x3);
​
function setUp() public {
token = new USDToken(owner);
vm.prank(owner);
token.mint(user, 1000 ether);
}
​
function testBurnVulnerability() public {
// Attacker gains control of user's address
vm.startPrank(attacker);
vm.deal(user, 1 ether); // Ensure user has some ether for gas
vm.prank(user);
token.approve(attacker, 1000 ether); // Attacker gets approval to burn tokens
​
// Attacker burns user's tokens
token.burn(1000 ether);
​
// Check user's balance is zero
assertEq(token.balanceOf(user), 0);
vm.stopPrank();
}
}

Impact

While it permits any holder to burn their own tokens, which aligns with standard ERC20 implementations, there is a risk. If an attacker gains control of a user's address, they could burn the user's tokens, resulting in asset loss for the user.

Tools Used

Manual Review

Recommendations

1. Implement optional role-based access control to restrict token burn permissions.

2. Educate users on securing private keys to prevent unauthorized access.

3. Monitor burn transactions for unusual activity and alert users of any detected anomalies.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.