094.md

shealtielanz

high

The Entire Funtionality Of The USSD Protocol Can Be Corrupted.

Line of Code Lines of Code

Summary

The Visibility of the mintRebalancer and burnRebalancer functions is set to Public with no modifier to ensure that only trusted party can call it, meaning the function can be called by Anyone.

Vulnerability Detail

There is no modifier to protect the mintRebalncer and burnRebalancer functions from being called by anyone which leaves the contract prone to malicious parties who can call these functions at any time to mint or burn any amount of USSD tokens. In the USSD contract

Lines of Code

    function mintRebalancer(uint256 amount) public override {
        _mint(address(this), amount);
    }

    function burnRebalancer(uint256 amount) public override {
        _burn(address(this), amount);
    }

This function is supposed to be called only by the rebalancer contract but without the modifier to check the mint and burn functions respectively, it can be called by anyone especially malicious actors to Mint or Burn any amount of USSD tokens in that contract

Impact

Malicious actors can burn all the tokens and intentionally disrupt the tokenSupply, create artificial scarcity or Inflation, manipulate prices, or Exploit imbalances in the system for personal gain.

This can also lead to the malfunction of the Rebalancer contract causing it to wrongly adjust the distribution of tokens within the pool. This Issue is Critical and the likelihood is High as it costs little to no amount to cause such extreme Damage to the Protocol.

Code Snippet

https://github.com/USSDofficial/ussd-contracts/blob/f44c726371f3152634bcf0a3e630802e39dec49c/contracts/USSD.sol#LL204C1-L210C6

Tool used

Manual Review

Recommendation

This issue can be fixed by simply adding the missing modifier onlyBalancer which ensures that only the rebalancer contract can call this function to the mintReblancer and burnRebalancer functions

    function mintRebalancer(uint256 amount) public override onlyBalancer {
        _mint(address(this), amount);
    }

    function burnRebalancer(uint256 amount) public override onlyBalancer {
        _burn(address(this), amount);
    }

This will implement a strict authorization process on the function making sure it can only be called by the right party.