Core Contracts

Summary

The IndexToken contract's mint function lacks any access control, allowing any external account to mint tokens arbitrarily. This vulnerability can lead to severe token inflation and undermine the integrity of the token and the broader protocol.

Vulnerability Details

In the IndexToken contract, the mint function is defined as follows:

There is no access control modifier (e.g., onlyOwner, onlyMinter) applied to the function. As a result, any user or contract can call mint and create new tokens at will. Since this function is used by the NFTLiquidator contract to mint tokens during liquidation events, the absence of proper restrictions allows an attacker or any arbitrary external actor to exploit this function and mint an unlimited supply of tokens.

Impact

• Token Inflation:
  Unrestricted minting could drastically inflate the token supply, diluting the value of tokens held by legitimate users.

• Economic Manipulation:
  Malicious actors might mint tokens arbitrarily and sell them on the market, undermining confidence in the token and potentially destabilizing the protocol's economy.

• Loss of Trust:
  The absence of access control could lead to significant loss of trust among token holders and investors, as the security and economic integrity of the protocol are compromised.

Tools Used

• Manual code review

Recommended Mitigation

• Implement Access Control:
  Modify the mint function to restrict its use to only authorized addresses. For example, if only the contract owner or a designated minter should be allowed to mint tokens, apply an appropriate modifier:

  function mint(address to, uint256 amount) external onlyOwner {

  if (to == address(0)) revert InvalidAddress();

  _mint(to, amount);

  }

  Alternatively, if a specific minter role is desired, use a role-based access control mechanism (e.g., OpenZeppelin's AccessControl) to restrict access:

  bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");

  ​

  function mint(address to, uint256 amount) external onlyRole(MINTER_ROLE) {

  if (to == address(0)) revert InvalidAddress();

  _mint(to, amount);

  }