code-423n4 / 2023-01-numoen-findings

0 stars 0 forks source link

Everyone can call mint function (no checks for msg.sender) #226

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-01-numoen/blob/2ad9a73d793ea23a25a381faadc86ae0c8cb5913/src/core/Lendgine.sol#L71-L79

Vulnerability details

Impact

Everyone can call mint function. There is no checks for msg.sender. I am not sure that this is okay and by method design.

Proof of Concept

https://github.com/code-423n4/2023-01-numoen/blob/2ad9a73d793ea23a25a381faadc86ae0c8cb5913/src/core/Lendgine.sol#L71-L79

Tools Used

Static analytics

Recommended Mitigation Steps

Think about how to protect method

c4-judge commented 1 year ago

berndartmueller marked the issue as unsatisfactory: Insufficient quality