Burn & Mint Functions open to public call access, No check for user balance before burning token

Description

• The functions mint(), burn() should have restricted access to the deployer of contract or specific addresses, and the burn function should revert if the specified value to burn exceeds the account balance

• 1. The Burn and Mint functions do not have access control checks
  2. The Burn function has no check for the value specified against the balance of the account, to revert if value is large

Risk

Likelihood:

• Attacker can exploit the mint function when they call the mint function specifying their own address

• Attacker can exploit the burn function when they call the mint function specifying an address with a value higher than the Balance available for that address

Impact:

• Attacker generates value for themselves out of thin air and exchange it on Exchanges for relative value in other tokens

Proof of Concept

Recommended Mitigation