Submitted by cccz
The owner of the JBToken contract can mint arbitrary amount of tokens.
In general, the owner of the JBToken contract is the JBTokenStore contract, and the minting of the tokens is controlled by the JBController contract, but when the changeTokenOf function of the JBController contract is called, the owner will be transferred to any address, which can mint arbitrary amount of tokens.
https://github.com/jbx-protocol/juice-contracts-v2-code4rena//blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBToken.sol#L106-L114
Consider setting minter as the JBTokenStore contract and adding the onlyminter modifier to the mint function.
mejango (Juicebox) acknowledged 
