Missing Access Control

1# { "Depends": "py-genlayer:15qfivjvy80800rh998pcxmd2m8va1wq2qzqhz850n8ggcr4i9q0" }2​3from genlayer import *4import json5​6# Module 5 (Vulnerable) -- Missing access control.7# `mint` is annotated @gl.public.write but performs no sender check.8# Any address on the network can mint tokens to themselves indefinitely.9# Deployment succeeds; the bug is observable at call-time.10​11​12class VulnerableVault(gl.Contract):13    balances_json: str14    total_supply: str15​16    def __init__(self):17        self.balances_json = "{}"18        self.total_supply = "0"19​20    @gl.public.write21    def mint(self, amount: int) -> None:22        # BUG: no auth.23        addr = str(gl.message.sender_address)24        balances = json.loads(self.balances_json)25        balances[addr] = int(balances.get(addr, 0)) + int(amount)26        self.balances_json = json.dumps(balances)27        self.total_supply = str(int(self.total_supply) + int(amount))28​29    @gl.public.view30    def balance_of(self, addr: str) -> str:31        balances = json.loads(self.balances_json)32        return str(int(balances.get(addr, 0)))33​34    @gl.public.view35    def get_total_supply(self) -> str:36        return self.total_supply

1# { "Depends": "py-genlayer:15qfivjvy80800rh998pcxmd2m8va1wq2qzqhz850n8ggcr4i9q0" }2​3from genlayer import *4import json5​6# Module 5 (Patched) -- Role-based access control.7# Owner is set in the constructor from the deployer's address; only the8# owner can grant/revoke minter rights; only minters can mint.9​10​11class SecureVault(gl.Contract):12    owner: str13    minters_json: str       # {"0xabc...": true, ...}14    balances_json: str15    total_supply: str16​17    def __init__(self):18        deployer = str(gl.message.sender_address)19        self.owner = deployer20        self.minters_json = json.dumps({deployer: True})21        self.balances_json = "{}"22        self.total_supply = "0"23​24    def _require_owner(self) -> None:25        if str(gl.message.sender_address) != self.owner:26            raise Exception("only owner")27​28    def _require_minter(self) -> None:29        minters = json.loads(self.minters_json)30        if not minters.get(str(gl.message.sender_address), False):31            raise Exception("only minter")32​33    @gl.public.write34    def add_minter(self, addr: str) -> None:35        self._require_owner()36        minters = json.loads(self.minters_json)37        minters[addr] = True38        self.minters_json = json.dumps(minters)39​40    @gl.public.write41    def remove_minter(self, addr: str) -> None:42        self._require_owner()43        minters = json.loads(self.minters_json)44        minters[addr] = False45        self.minters_json = json.dumps(minters)46​47    @gl.public.write48    def mint(self, amount: int) -> None:49        self._require_minter()50        addr = str(gl.message.sender_address)51        balances = json.loads(self.balances_json)52        balances[addr] = int(balances.get(addr, 0)) + int(amount)53        self.balances_json = json.dumps(balances)54        self.total_supply = str(int(self.total_supply) + int(amount))55​56    @gl.public.view57    def balance_of(self, addr: str) -> str:58        balances = json.loads(self.balances_json)59        return str(int(balances.get(addr, 0)))60​61    @gl.public.view62    def is_minter(self, addr: str) -> str:63        minters = json.loads(self.minters_json)64        return "true" if minters.get(addr, False) else "false"65​66    @gl.public.view67    def get_total_supply(self) -> str:68        return self.total_supply