Submitted by NPCsCorp, also found by seraviz, dutra, 0xSimeon, EV_om, azanux, Aymen0909, 0xprinc, ZdravkoHr, 0x11singh99, CDSecurity, nuthan2x, GhK3Ndf, 0xAadi, Eeyore, ZanyBonzy (1, 2), DadeKuma, Matue, Timeless, Giorgio, slylandro_star, 0xdice91, Nikki, ke1caM, cu5t0mpeo, Greed, nobody2018, Tendency, Inference, al88nsk, DarkTower, th13vn, Soliditors, Timenov, wangxx2026, NentoR, ether_sky, peanuts, MrPotatoMagic, ravikiranweb3, mrudenko, Kaysoft, deth, 0xBugSlayer, nmirchev8, GeekyLumberjack, Aamir, adeolu, stealth, simplor, PUSH0, 0xabhay, darksnow, haxatron, m4ttm, 0xE1, boredpukar, abiih, 0xSmartContract, bareli, mgf15 (1, 2, 3, 4), vnavascues, d4r3d3v1l, zaevlad, 0xPluto, rouhsamad, Krace, kodyvim, Tigerfrake, JanuaryPersimmon2024, and piyushshukla
By allowing anybody to set the address of the Router contract to any address they want to set it allows malicious users to get access to the mint and burn functions of the DcntEth contract.
The DcntEth::setRouter() function has not an access control to restrict who can call this function. This allows anybody to set the address of the router contract to any address theyd like to set it.
The functions DcntEth::mint() function & DcntEth::burn() function can be called only by the router contract.
A malicious user can set the address of the router contract to an account of their own and:
Make sure to add an Acess Control mechanism to limit who can set the address of the Router in the DcnEth contract.
0xsomeone (Judge) commented:
wkantaros (Decent) confirmed
