Decent - Timeless's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L18-L22

Vulnerability details

Impact

In the contract DcntEth.sol, the function setRouter() can be called by ANYONE, due to which any person would be able to control the control and can mint/burn any amount of tokens.

Proof of Concept

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L18-L22

Tools Used

Manual Review

Recommended Mitigation Steps

Consider adding an onlyOwner() modifier over the given function and also initialize the router address in the constructor, i.e.

constructor(address _layerZeroEndpoint, address _router) OFTV2("Decent Eth", "DcntEth", 18, _layerZeroEndpoint) {
router = router;  // add this 
}

    function setRouter(address _router) public onlyOwner { //add this
        router = _router;
    }

Assessed type

Access Control