035.md

blockdev

high

Anyone can mint and burn any USSD amount

Summary

Any amount of USSD can be minted or burned free of cost.

Vulnerability Detail

USSD has these two functions:

function mintRebalancer(uint256 amount) public override {
    _mint(address(this), amount);
}

function burnRebalancer(uint256 amount) public override {
    _burn(address(this), amount);
}

These functions don't have any access control guards and can be called by anyone.

Impact

High. This amount can only be minted or burned for the USSD contract, it will lead to a change in total supply of USSD leading to a change in collateralFactor and will lead to an incorrect rebalancing.

Code Snippet

function mintRebalancer(uint256 amount) public override {
    _mint(address(this), amount);
}

function burnRebalancer(uint256 amount) public override {
    _burn(address(this), amount);
}

Tool used

Manual Review

Recommendation

Add onlyBalancer modifier to mintRebalancer() and burnRebalancer() functions.