Critical: accrue_postpaid_debt has no access control - anyone can force-slash any user's collateral

[leanworld7-netizen]

Critical: accrue_postpaid_debt has no access control - anyone can force-slash any user's collateral

Summary

The accrue_postpaid_debt function (line 8586 of contracts/utility_contracts/src/lib.rs) is a public contract function with zero authorization checks. Any caller can add arbitrary debt to any user's GuarantorDeposit, pushing the debt-to-collateral ratio above SLASH_THRESHOLD_BPS and triggering automatic slashing of the victim's locked collateral.

Affected Function

contracts/utility_contracts/src/lib.rs line 8586:

[addnad]

hi maintainer, ive read the description and i have the experience to review the issue, implement a clean solution, test it, and submit a pull request.

[apatafamilycompound123-ops]

Hello Maintainer, I'd like to work on this issue. I have experience with blockchain development and state management, and I can implement this. Please consider assigning it to me.

[khaylebfortune]

Hello Maintainer, I can fix this issue.
Please assign me.