code423n4 commented 2 years ago

Lines of code

Vulnerability details

User can accidentally burn PUSD tokens.

PUSD Coin inherits from ERC20Burnable which according to OZ ` /**

@dev Extension of {ERC20} that allows token holders to destroy both their own
tokens and those that they have an allowance for, in a way that can be
recognized off-chain (via event analysis). */ ` This contact has the exposed function.

function burn(uint256 amount) public virtual { _burn(_msgSender(), amount); }

I believe that this functionality makes no sense for a stable coin. It is just dangerous and can make users lose their funds.

Manual code review

Remove the ERC20Burnable.

spaghettieth commented 2 years ago

There's no way a user would call burn without knowing what it does.

dmvt commented 2 years ago

If the user calls burn, they clearly intend to burn their tokens.