Lines of code

Vulnerability details

Impact

If by any means this function is not called first by the creators anyone can be the one to define it forever since there is no verification, after that the attacker will have complete control over the mint and burn functions.

#Proof of Concept

    function setVault(address _vault) external {
        if (vault != address(0x0)) {
            revert();
        }
        vault = _vault;
    }

Tools Used

Manual

Recommended Mitigation Steps

Be sure to assign it when deploying the contract or add a new modifier so it can still be defined only once but only by the right person.

The text was updated successfully, but these errors were encountered:

All reactions