Spot the bug: access control

Spot the bug — access control

A function that should be restricted but isn't is one of the most common (and most embarrassing) bug classes. Anyone who calls it can do whatever it does — drain the contract, mint tokens, change the owner.

Vulnerable mint

Click the line you think is the bug

Vulnerable mint

1Line 1: function mint(address to, uint amount) public {2Line 2: totalSupply += amount;3Line 3: balances[to] += amount;4Line 4: }5Line 5: 6Line 6: function setOwner(address newOwner) public {7Line 7: owner = newOwner;8Line 8: }

Reveal the bug