Submitted by 0x1f8b
Using the burn() function of Yieldy, an address with MINTER_BURNER_ROLE can burn an arbitrary amount of tokens from any address.
We believe this is unnecessary and poses a serious centralization risk.
A malicious or compromised MINTER_BURNER_ROLE address can take advantage of this.
Consider removing the MINTER_BURNER_ROLE and change burn() function to:
toshiSat (Yieldy) acknowledged and commented:
JasoonS (judge) commented:
