QA Report

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L7

Vulnerability details

Impact

Same as code-423n4/2022-01-livepeer-findings#193

The VUSD contract inherits from the ERC20PresetMinterPauser contract

Using the mint() function of ERC20PresetMinterPauser, an address with MINTER_ROLE can mint an arbitrary amount of tokens.

If the private key of the deployer or an address with the MINTER_ROLE is compromised, the attacker will be able to mint an unlimited amount of VUSD tokens.

We believe this is unnecessary and poses a serious centralization risk.

Proof of Concept

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L7

Tools Used

None

Recommended Mitigation Steps

Consider removing the MINTER_ROLE, make the VUSD only mintable by the owner, and make the MarginAccount contract to be the owner and therefore the only minter.

[atvanguard]

Duplicate of #48

[JeeberC4]

Since this issue was downgraded to a QA level, and the warden did not submit a separate QA report, we've renamed this one to "QA report" for consistency.
The original title, for the record, was MINTER_ROLE can be granted by the deployer of VUSD and mint arbitrary amount of tokens