Platform: Code4rena
Start Date: 19/01/2024
Pot Size: $36,500 USDC
Total HM: 9
Participants: 113
Period: 3 days
Judge: 0xsomeone
Id: 322
League: ETH
Rank: 82/113
Findings: 1
Award: $0.12
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: NPCsCorp
Also found by: 0x11singh99, 0xAadi, 0xBugSlayer, 0xE1, 0xPluto, 0xSimeon, 0xSmartContract, 0xabhay, 0xdice91, 0xprinc, Aamir, Aymen0909, CDSecurity, DadeKuma, DarkTower, EV_om, Eeyore, GeekyLumberjack, GhK3Ndf, Giorgio, Greed, Inference, JanuaryPersimmon2024, Kaysoft, Krace, Matue, MrPotatoMagic, NentoR, Nikki, PUSH0, Soliditors, Tendency, Tigerfrake, Timeless, Timenov, ZanyBonzy, ZdravkoHr, abiih, adeolu, al88nsk, azanux, bareli, boredpukar, cu5t0mpeo, d4r3d3v1l, darksnow, deth, dutra, ether_sky, haxatron, ke1caM, kodyvim, m4ttm, mgf15, mrudenko, nmirchev8, nobody2018, nuthan2x, peanuts, piyushshukla, ravikiranweb3, rouhsamad, seraviz, simplor, slylandro_star, stealth, th13vn, vnavascues, wangxx2026, zaevlad
0.1172 USDC - $0.12
Anyone can mint or burn DcntEth tokens in any amount.
There is present the mint and burn function that can be called only by the router address. The issue is in the implementation of DcntEth.sol/setRouter() function.
function setRouter(address _router) public { router = _router; }
This function lacks validation of msg.sender which allows anyone to call this function and become router and hence will be able to mint and burn DcntEth tokens.
Manual Review
The function DcntEth.sol/setRouter() should include an onlyOwner modifier which will only let owner to set the router address.
Access Control
#0 - c4-pre-sort
2024-01-25T04:24:25Z
raymondfam marked the issue as sufficient quality report
#1 - c4-pre-sort
2024-01-25T04:24:32Z
raymondfam marked the issue as duplicate of #14
#2 - c4-judge
2024-02-03T13:09:56Z
alex-ppg marked the issue as satisfactory