Description
Anyone can take over the minting privileges from the vesting contract and control the minting functionality. In spite of checking that the sender is a privileged account, this parameter has no authorization checks in update_minter and update_minter_capacity
Coinspect determined that there is a high likelihood of this attack occurring, as anyone can execute it with minimal effort. Since the minting function only allows generating balance to the vesting contract, attackers are not capable of increasing their balance. However, since vesting tokens cam be minted freely, the total supply can be easily manipulated and disrupt the nature of the token. Because of these reasons, the impact is also considered to be high.
Recommendation
Require the sender to be authorized when updating the minter and its capacity.
Location
Description Anyone can take over the minting privileges from the vesting contract and control the minting functionality. In spite of checking that the sender is a privileged account, this parameter has no authorization checks in
update_minterandupdate_minter_capacityCoinspect determined that there is a high likelihood of this attack occurring, as anyone can execute it with minimal effort. Since the minting function only allows generating balance to the vesting contract, attackers are not capable of increasing their balance. However, since vesting tokens cam be minted freely, the total supply can be easily manipulated and disrupt the nature of the token. Because of these reasons, the impact is also considered to be high.
Recommendation Require the sender to be authorized when updating the minter and its capacity.