[WP-H3] MINTER_ROLE of VUSD can rug users with unlimited mint()

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/ed1d885d5dbc2eae24e43c3ecbf291a0f5a52765/contracts/VUSD.sol#L11-L11

Vulnerability details

https://github.com/code-423n4/2022-02-hubble/blob/ed1d885d5dbc2eae24e43c3ecbf291a0f5a52765/contracts/VUSD.sol#L11-L11

contract VUSD is VanillaGovernable, ERC20PresetMinterPauserUpgradeable {

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/v4.3.2/contracts/token/ERC20/presets/ERC20PresetMinterPauserUpgradeable.sol#L67-L70

    function mint(address to, uint256 amount) public virtual {
        require(hasRole(MINTER_ROLE, _msgSender()), "ERC20PresetMinterPauser: must have minter role to mint");
        _mint(to, amount);
    }

The address that initialize() the VUSD contract, usually, the deployer of the contract will have MINTER_ROLE by default, furthermore, the deployer and any other address with the DEFAULT_ADMIN_ROLE can grant MINTER_ROLE to anyone with no reactions.

We believe this can introduce a severe centralization risk, which can cause users to be rugged by the malicious/compromised deployer or other addresses with MINTER_ROLE.

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/v4.3.2/contracts/token/ERC20/presets/ERC20PresetMinterPauserUpgradeable.sol#L51-L56

    function __ERC20PresetMinterPauser_init_unchained(string memory name, string memory symbol) internal initializer {
        _setupRole(DEFAULT_ADMIN_ROLE, _msgSender());

        _setupRole(MINTER_ROLE, _msgSender());
        _setupRole(PAUSER_ROLE, _msgSender());
    }

Recommendation

Consider limiting power of the deployer, including:

1. the MINTER_ROLE should only be held by contracts but not EOAs;
2. the MINTER_ROLE should not be granted in one step by an EOA, but in 2 steps and it should be granted by a multi-sig or DAO gov contract only.

[atvanguard]

Duplicate of #40

[JeeberC4]

Grouping with warden's QA Report #96