Lines of code

Vulnerability details

Impact

By leaving _mint_to_Accountant() with no access control when accountant = address(0) it allows an attacker to call the function, mint the entire supply to themselves, and gain the accountant and admin roles. Additionally, the parameter “address accountantDelegator” is expected but never used in the function.

Proof of Concept

Note.sol#L13

Recommended Mitigation Steps

Add admin access control to the _mint_to_Accountant() function

The text was updated successfully, but these errors were encountered:

All reactions