# Anyone can update the address of the Router in the DcntEth contract to any address they would like to set.

DcntEth.setRouter lacked access control, letting anyone point the router to their own address and mint/burn DcntEth to drain or sabotage DecentEthRouter liquidity.

- Payout: Contest reward
- Severity: high
- Program: Decent
- Credited: NPCsCorp
- Disclosed: 2024-03-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-decent-findings/issues/721
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-decent%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** DcntEth ERC20 token contract / DecentEthRouter bridge
**Root cause:** setRouter(address) is public with no access control, and mint/burn are gated only by onlyRouter, so anyone can become the router.
**Steps:**
1. Call `DcntEth.setRouter(attackerAddress)` from any account.
2. Deploy attacker contract that calls `DcntEth.mint(attacker, amount)` or `DcntEth.burn(victim, amount)`.
3. Mint unlimited DcntEth to disrupt crosschain accounting or drain WETH deposited in DecentEthRouter.
4. Alternatively burn DecentEthRouter's DcntEth balance to break add/removeLiquidity flows (DoS).
**How found:** Code review of DcntEth.sol spotted setRouter with no modifier, then traced onlyRouter-gated mint/burn and router call sites in DecentEthRouter.
**Exploitation:** Attacker sets router to own contract, then mints arbitrary DcntEth to themselves or burns the router's balance, breaking liquidity accounting and enabling theft of deposited WETH/ETH or DoS of add/remove liquidity.
**Escalation:** Compromises entire TVL of Decent ETH token per judge; arbitrary mints drain UTB liquidity, arbitrary burns sabotage pools and escrow contracts.
**Insight:** When a token gates privileged mint/burn behind an onlyRouter modifier, verify the router setter itself is access-controlled; a single unprotected setter collapses the whole trust boundary.