Dangerous burn public

[code423n4]

Lines of code

https://github.com/code-423n4/2022-03-prepo/blob/f63584133a0329781609e3f14c3004c1ca293e71/contracts/core/LongShortToken.sol#L8-L16

Vulnerability details

Impact

Users can burn Long/Short token accidentally

Proof of Concept

As LongShortToken.sol inherits from ERC20Burneable the function burn() is public. So users can call it accidentally and burn their tokens. It is much better override with a no operation to avoid this.

Tools Used

Manual code review

Recommended Mitigation Steps

Add this line to LongShortToken.sol (or something similar)

function burn(uint256 amount) public override {
    revert("disabled");
}

[ramenforbreakfast]

I do not consider this valid. I don't see how a user would accidentally call a burn function.

[gzeoneth]

Agree with sponsor, downgrading to Low/QA. Closing in favor of warden's QA report #106