Centralization risk allows to burn / steal tokens from anyone

[hats-bug-reporter[bot]]

Github username: -- Twitter username: -- Submission hash (on-chain): 0x6fae2ca3c91878d5d2a921355875b844e18bcd0f6bb19038a932bb995518a03f Severity: medium

Description: Description\ src/InvestToken.sol::recover allows burning stealing tokens from an arbitrary address and minted the burned amount to an arbitrary address

Attack Scenario\ src/InvestToken.sol::recover allows burning stealing tokens from an arbitrary address and minted the burned amount to an arbitrary address, so an user can lost all of his investment if a user with a RESCUER_ROLE decides to use this method with his address as from parameter

    function recover(address from, address to, uint256 amount) public onlyRole(RESCUER_ROLE) returns (bool) {
        _burn(from, amount);
        _mint(to, amount);

        emit Recovered(from, to, amount);

        return true;
    }

Attachments

1. Proof of Concept (PoC) File

2. Revised Code File (Optional)

[AndreiMVP]

We'll assume RESCUER_ROLE is trusted. This is similar function to what other stablecoins have for compliance reasons