Anyone can burn their tokens, locking collateral in contract

[codehawks-bot]

Anyone can burn their tokens, locking collateral in contract

Severity

High Risk

Summary

Anyone can burn their tokens, locking collateral in contract

Vulnerability Details

DecentralizedStableCoin.sol has two onlyOwner functions, burn and mint and only DSCEngine should be able to burn and mint new tokens.

However ERC20Burnable has another function, burnFrom which can be used to burn tokens by any account.

PoC

function testNoOtherAccountCanBurnTokensUsingBurnFrom() public {
        // Alice has two accounts
        address ALICE = address(1337);
        address ALICE2 = address(1338);

        vm.prank(dsc.owner());
        dsc.mint(ALICE, 100);
        
        // Alice approves her second account
        vm.prank(ALICE);
        dsc.approve(ALICE2, 1);

        // Alice should not be able to use her second account to burn her tokens
        vm.prank(ALICE2);
        vm.expectRevert();
        dsc.burnFrom(ALICE, 1);
        
    }

Impact

Any account can burn tokens from approved addresses, locking collateral in the contract and breaking the assumption of DSCEngine being the only burner of tokens.

Tools Used

Manuel review

Recommendations

Override burnFrom() from ERC20Burnable or don’t use ERC20Burnable and use ERC20 directly instead.