Submitted by WatchPug, also found by catchup, Lambda, p4st13r4, and Tutturu
https://github.com/Plex-Engineer/lending-market/blob/b93e2867a64b420ce6ce317f01c7834a7b6b17ca/contracts/Note.sol#L13-L31
_mint_to_Accountant() calls _setAccountantAddress() when accountant == address(0), which will always be the case when _mint_to_Accountant() is called for the first time.
And _setAccountantAddress() only checks if msg.sender == admin when accountant != address(0) which will always be false, therefore the access control is not working.
L17 will then check if msg.sender == accountant, now it will always be the case, because at L29, accountant was set to msg.sender.
tkkwon1998 (Canto) confirmed
Alex the Entreprenerd (judge) commented:
