Decent - Krace's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

Vulnerability details

Impact

The function setRouter lacks proper permission verification, allowing any user to set up a new router and freely mint and burn tokens.

Proof of Concept

The function setRouter lacks proper permission verification, allowing any user to set up a new router and freely mint and burn tokens.

//@audit anyone can set a router, to mint and burn
    function setRouter(address _router) public {
        router = _router;
    }

    function mint(address _to, uint256 _amount) public onlyRouter {
        _mint(_to, _amount);
    }

    function burn(address _from, uint256 _amount) public onlyRouter {
        _burn(_from, _amount);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Add onlyOwner to the function setRouter.

Assessed type

Access Control