043.md

qbs

high

Lack of proper access control in mintRebalancer and burnRebalancer functions

Summary

The mintRebalancer and burnRebalancer functions do not have any access control modifiers. This means that anyone can call these functions and manipulate the token supply by minting or burning an arbitrary amount of tokens.

Vulnerability Detail

The functions mintRebalancer and burnRebalancer lack proper access control measures, such as modifiers, to restrict their usage. As a result, any external entity can invoke these functions without any authorization or restrictions. This opens up the possibility for malicious actors to manipulate the token supply by minting or burning tokens in arbitrary amounts.

Impact

Anyone can arbitrarily mint and burn USSD tokens.

Code Snippet

USSD.sol#L204-L210

function mintRebalancer(uint256 amount) public override {
        _mint(address(this), amount);
    }

    function burnRebalancer(uint256 amount) public override {
        _burn(address(this), amount);
    }

Tool used

Manual Review

Recommendation

Implement access control mechanisms or modifiers in the mintRebalancer and burnRebalancer functions. One possible solution is to add a modifier like onlyBalancer, which ensures that only the specified rebalancer address can call these functions.