Submitted by xYrYuYx
https://github.com/code-423n4/2021-11-overlay/blob/main/contracts/ovl/OverlayToken.sol#L366
The burner could burn any amount of tokens of any user.
This is not good solution of burn
Manual
Update burn function for only owner can burn his tokens.
Now, ovl.burn function is used in OverlayV1OVLCollateral.sol file, and these updates wont make any issue in protocol.
mikeyrf (Overlay) acknowledged:
