🟡 `burn` acts as an open proxy for arbitrary token contracts, and skips `burn_enabled` for unknown tokens

[Ejirowebfi]

Area: Smart contract · lib.rs (burn)

Description

burn(token_address, from, amount) never verifies that token_address was deployed by this factory.
For unknown addresses the TokenIndex lookup simply returns None and the function proceeds to call
balance and burn on the arbitrary external contract — meaning (a) the factory-wide invariant
"a token's burn_enabled flag gates burning" only applies to known tokens, and (b) the factory
happily forwards calls (and emits its own official-looking burn events, polluting the indexed
history that Transaction History renders) for any contract anyone points it at. A malicious contract
at token_address also gets to execute arbitrary code mid-call with the factory as caller — the
reentrancy lock protects factory state, but the factory still lends its event log and its transaction
context to whatever the callee does. There is no legitimate use of factory-burn for non-factory
tokens; holders of external tokens can burn directly on those contracts.

Tasks

• Require TokenIndex(token_address) to exist in burn; return TokenNotFound otherwise
  (making the burn_enabled check unconditional as a side effect).
• Audit mint_tokens, set_metadata, and set_burn_enabled for the same trust boundary
  (they currently do check the owner key — add explicit tests locking that in).
• Add tests: burn on a never-registered address fails; burn events are only ever emitted for
  factory tokens; burn_enabled=false blocks burn for every factory token with no bypass.
• Update docs/contract-abi.md (burn errors gain TokenNotFound).

Acceptance criteria

• The factory only ever invokes token contracts it deployed, proven by tests.
• No code path can burn a factory token whose burn_enabled is false, and no factory burn event
  can reference a non-factory token.

---

Issue 17 of 20 from the codebase audit tracked in ISSUES.md.

[ebubeb683-ship-it]

please i would to work on this task

[JoesWalker]

Hello maintainer i would like to work on this issue i have gone through the issue and know how to solve the issue

[grantfox-oss]

🦊 GrantFox — @JoesWalker has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #1021)
2. Your PR will be reviewed by the Favourorg maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@JoesWalker's PR #1059 was approved and merged by @Ejirowebfi.

🏆 @JoesWalker: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (379 total points). Track your full progress on GrantFox.

👏 Great work, @JoesWalker! Keep contributing to Favourorg.