chainNue - Missing crucial modifier on mintRebalancer and burnRebalancer functions

[sherlock-admin]

chainNue

high

Missing crucial modifier on mintRebalancer and burnRebalancer functions

Summary

Missing crucial modifier on mintRebalancer and burnRebalancer functions

Vulnerability Detail

In the USSD contract, there are functions which open for public, mintRebalancer and burnRebalancer. This basically will mint to and burn the token from USSD contract itself.

Either this is overlooked by the USSD team, or intended-low-hanging fruits, and it's unlikely a protocol design (because it can be abusive thing to do, for example to mint a large amount supply, which then affecting the rebalance() function)

Impact

Anyone can front-run any rebalance, and increase the supply amount, resulting invalid calculation on rebalance, especially when the uint256 amount = IUSSD(USSD).balanceOf(USSD); being used.

Another case, it will make collateralFactor to be 0, because the large totalSupply

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L204-L210

Tool used

Manual Review

Recommendation

Add modifer onlyBalancer to the functions.

Duplicate of #777