search

code-423n4 / 2022-10-thegraph-findings

0 stars 0 forks source link

[NAZ-M2] `MINTER_ROLE` Can Be Granted By The Deployer and Can Mint Arbitrary Amount of Tokens #245

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/l2/token/GraphTokenUpgradeable.sol#L158

Vulnerability details

Impact

If the private key of the deployer or an address with the MINTER is compromised, the attacker will be able to mint an unlimited amount of tokens. I believe this is unnecessary and poses a serious centralization risk.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider removing the MINTER, make the tokens only mintable by the owner, and make the L2Minter contract to be the owner and therefore the only minter.

0xean commented 1 year ago

closing as invalid.