DexLyn Disclosed Report

https://github.com/hackenproof-public/tokenomics_contract

Location: tokenomics_contract/sources/fee_distributor.move Description

burn_rebase is documented “Only a voter can call,” but it never asserts the caller is a voter. It calls voting_escrow::is_voter(voter_address); and discards the result.

Impact

Unauthorized mint-in of DXLYN to the distributor contract by any friend module path that can call burn_rebase (it’s public fun, not entry), spoofing a “voter-origin” rebase event.

Event stream (RebaseAddedEvent) becomes untrustworthy; accounting expectations that rely on “only voters add rebases” are broken.

Proof of Concept // From any friend that can import fee_distributor: fee_distributor::burn_rebase(&any_signer, &sender, 1_000);

Succeeds even if any_signer is not a voter.

Proof of Code

burn_rebase (friend function): calls voting_escrow::is_voter(voter_address); but no assert!(...).

Mitigation

Enforce the check:

let voter_address = address_of(voter);
assert!(is_voter(voter_address), ERROR_NOT_ALLOWED);

(And consider making it entry if you truly want on-chain auth via a signer.)