SOLIDITY INCORRECT ACCESS CONTROL
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Access controls define the restrictions around privileges and roles of users in an application. Access control in smart contracts can be related to governance and critical logic like minting tokens, voting on proposals, withdrawing funds, pausing and upgrading the contracts, changing ownership, etc. File 5 of 15: ERC20Burnable.sol We will notice that the burn function is public and hence any user can call the burn function.Line 36-40
an attacker could purchase any token and then call the public burn function to burn all the tokens on UniSwap, creating inflation and hence increasing the worth of the token and then swapping it for ETH till the pool is exhausted. This could have been prevented if the function had access control implemented like onlyOwner or the function was internal with correct access control logic.
Difficulty to Exploit: Easy Weakness: CVSS2 Score:
Proof of concept
Visit the url and read smart contracts carefully.Scroll down to File 5 of 15: ERC20Burnable.sol We will notice that the burn function is public and hence any user can call the burn function.Line 36-40
This is not a security bug report because it is intended behavior that a user can burn anyone else's tokens as long as the owner of the tokens signed the allowance. A user can also burn any Beans they want, as long as they own the tokens.
Due to these reasons, we are closing the submission and no reward will be issued.
Of course, you can burn anyone else's tokens as long as that person signed the allowance. Just like
transferFrom(). And sure, you can burn any BEAN you want... As long as you own it.