Open code423n4 opened 1 year ago
Mentioned as low here https://github.com/code-423n4/2023-05-xeth-findings/blob/main/data/adriro-Q.md#l-4-potential-accidental-inclusion-of-erc20burnable-in-xeth-token . Only the holder or the allowed spender can burn their tokens.
vaporkane marked the issue as disagree with severity
vaporkane marked the issue as sponsor confirmed
This is a valid edge cases that users can burn their own tokens. However, there is no benefit to burn ones own tokens and just results in net gains for other users (as share price increases). As a result I consider this Low severity.
kirk-baird changed the severity to QA (Quality Assurance)
kirk-baird marked the issue as grade-a
Lines of code
https://github.com/code-423n4/2023-05-xeth/blob/d86fe0a9959c2b43c62716240d981ae95224e49e/src/xETH.sol#L9
Vulnerability details
Impact
anyone can burn without MINTER_ROLE
Proof of Concept
xETH
we will restrict mint/burn to only those withMINTER_ROLE
privileges The documentation is commented as follows:But currently
xETH
isERC20Burnable
, and there is noMINTER_ROLE
restriction inERC20Burnable.burn()/burnFrom()
. Then anyone can burn, breaking this restriction ruleTools Used
Recommended Mitigation Steps
remove
is ERC20Burnable
Assessed type
Context