#11 Price manipulation in SmartVault due to lack of access control in SmartVaultManager

Severity

High Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultManagerV5.sol#L70

Summary

In SmartVaultManagerV5.mint, there is no access control, which means anyone is able to mint a vault and become owner of the vault. This allows a malicious actor to mint high amount of EUROs which will potentially cause DoS and EURO/USD price to be manipulated to arbitrage tokens.

Vulnerability Details

SmartVaultManagerV5.mint() deploys a vault, and assigns owner to msg.sender. And also grants the role of vault of minting and burning EURO tokens. Since anyone is able to call mint function in manager contract, this makes anyone to be able to mint and burn EUROs in the vault contract as those are only allowed to be called by owner address. There is a limit on max minted amount, but this value can vary as it's determined by the price of other assets and the price of EURO and USD as defined in the PriceCalculator contract:

    function tokenToEurAvg(ITokenManager.Token memory _token, uint256 _tokenValue) external view returns (uint256) {
        Chainlink.AggregatorV3Interface tokenUsdClFeed = Chainlink.AggregatorV3Interface(_token.clAddr);
        uint256 scaledCollateral = _tokenValue * 10 ** getTokenScaleDiff(_token.symbol, _token.addr);
        uint256 collateralUsd = scaledCollateral * avgPrice(4, tokenUsdClFeed);
        (, int256 eurUsdPrice,,,) = clEurUsd.latestRoundData();
        return collateralUsd / uint256(eurUsdPrice);
    }

The attacker can first mint as many EURO as possible, and the attacker wait for the price of EURO to drop. Then, the attacker can burn the supply he/she has minted overtime at all, after a while, the price of EURO will rise again. Eventually the attacker can swap other tokens back for the high amount of EURO he/she has swapped before.

Impact

Token prices can be manipulated easily, and potential to lose funds.

Tools Used

Manual review

Recommendations

Add access control to make minter to stake some tokens when minting in SmartVaultManager.mint()