Closed code423n4 closed 1 year ago
Basically the same as vault rug, but missing further detail
GalloDaSballo marked the issue as unsatisfactory: Invalid
GalloDaSballo marked the issue as duplicate of #383
GalloDaSballo marked the issue as duplicate of #377
GalloDaSballo marked the issue as satisfactory
GalloDaSballo marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/StableToken.sol#L9 https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/StableToken.sol#L38
Vulnerability details
Impact
If the private key of the deployer or an address in the
isMinter
mapping is compromised, the attacker will be able to mint/burn an unlimited amount of tigUSD tokens.Tools Used
Manual Review
Recommended Mitigation Steps
Consider removing the
isMinter
mapping making tigUSD only mintable by the owner, and make thestableToken.sol
contract to be the owner and therefore the only minter.