Mintlayer (Audit #2)

The `addRoot()` permits a holder of the `MLTToken` to create a new vesting, and it checks if the caller holds enough tokens (in L125) when calling the function. However, this check is insufficient since there is no guarantee to ensure the caller will pay for the vesting tokens. For instance, an attacker can repeatedly create the vesting with his balance or dramatically inflate his balance instantly by flashloan and creating a huge investing schedule. ```solidity=113 function addRoot( bytes32 _root, uint256 _amount, uint256 _startTimestamp, bytes32[] calldata _proofBalance ) external { bytes32 _leaf = keccak256(abi.encodePacked(_amount)); require( MerkleProof.verify(_proofBalance, _root, _leaf), 'The supply sent does not match that of the merketree' ); require(_amount <= balanceOf(msg.sender), 'Amount exceeds balance'); require(!rootWhitelist[_root], 'Root hash already exists'); rootWhitelist[_root] = true; balanceByRootHash[_root] = _amount; startTimestampByRootHash[_root] = _startTimestamp; } ``` As the function relies only on the `balanceOf(msg.sender)`, an attacker can create multiple vestings by abusing the function `addRoot()`. This can lead to disastrous consequences as the attacker will set a vesting period extremely small, then withdraw tokens earlier than the previous vesting created by legitimate users of the project. The *scenarios* and a *proof of concept* to illustrate the attack are shown below,

The contracts `MLTTokenV1` and `MLTToken` inherit of `Ownable` library from OpenZeppelin but doesn't use features from it.