Submission Details
Severity:
Owner Can Burn Anyone's Tokens Without Approval
Description: The WToken::burn function allows the contract owner to burn tokens from any address without requiring approval. This violates the ERC20 standard's principle of user sovereignty over their tokens.
Impact:
Owner can unilaterally reduce any user's token balance
Violates user trust and token holder rights
May cause financial losses to token holders
Proof of Concept:
// 1. User has 100 tokens
// 2. Owner can burn them without approval:
wtoken.burn(userAddress, 100);
// 3. User loses tokens without consenting
Recommended Mitigation: Implement a system requiring user approval before burning tokens, similar to the ERC20 approve/transferFrom pattern.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
51929 USDC / LOC
14,000
1,000
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.