Security Audit Report

An attacker first calls setOwner(attacker) to gain DEFAULT_ADMIN_ROLE with no access check. With DEFAULT_ADMIN_ROLE, the attacker calls setAdministrator(attacker) to gain ADMIN role, then calls setMasterMinter(attacker) and addMinter(attacker, type(uint256).max) to gain unlimited minting capability. The attacker then mints arbitrary tokens to any address, destroys token value, and can authorize a malicious UUPS upgrade via _authorizeUpgrade to permanently compromise the proxy.

An attacker calls addController(attacker) with no access check to grant themselves the CONTROLLER role. They then call safetySwitch() to halt all minting and burning operations. Because _operatingController is set to the attacker's address, only the DEFAULT_ADMIN_ROLE or the attacker themselves can re-enable operations. If the attacker was also able to seize DEFAULT_ADMIN_ROLE via the unguarded setOwner, they can permanently lock the protocol. Even without owning DEFAULT_ADMIN_ROLE, the attacker can repeatedly disable and enable operations to grief the protocol.

In transferWithAuthorization, transferSanity is called first which invokes _payTxFee, deducting fees from the holder before signature verification occurs in the super call. An attacker can call transferWithAuthorization with any valid holder address and an invalid or replayed signature. The fee is deducted from the holder's balance, then the super call reverts due to invalid signature, but the fee payment via _update has already executed. This allows an attacker to repeatedly drain fees from any holder address.

The Forwarder accepts a caller-supplied domainSeparator without validating it against the token's actual EIP-712 domain. A malicious relayer can supply a domainSeparator from a different chain or deployment where the user previously signed a valid request. Because the nonce state may differ across deployments, a signature consumed on one chain may still be valid on another. Combined with the shared nonce namespace between permit and transferWithAuthorization, an attacker can front-run a pending transferWithAuthorization by submitting a permit with the same nonce to invalidate it, or replay a cross-domain signature via the unvalidated forwarder to execute an unauthorized transfer.