coryli
high
There are no restrictions on minting and burning tokens. An attacker can manipulate the collateral factor by minting an and burning arbitrary amounts of USSD tokens.
The functions mintRebalancer(uint256 amount) and burnRebalancer(uint256 amount) can be called by anyone, anytime with any amount passed.
Manipulating collateral factor and depegging USSD.
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L204-L206 https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/USSD.sol#L208-L210
Manual Review
Add onlyBalancer modifier to ensure it can only be called by the Rebalancer contract.