First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Uncontrolled Token Minting and Burning in SantaToken Contract

kevinkkien

Summary

The SantaToken smart contract allows for unregulated minting and burning of tokens, posing significant risks to the token's value and integrity.

Vulnerability Details

In the SantaToken contract, the mint and burn functions lack mechanisms to regulate the amount of tokens that can be minted or burned. This absence of control can lead to scenarios where a large number of tokens are minted or burned by the i_santasList address, potentially causing hyperinflation or deflation of the token's value.

Impact

Uncontrolled minting could lead to a significant devaluation of the token due to hyperinflation. Conversely, unrestricted burning could lead to a deflationary spiral, reducing the total supply of tokens to a detrimental level. Both scenarios can severely undermine investor confidence and the token's market stability.

Tools Used

manual

Recommendations

  • Minting Cap: Introduce a cap on the total supply of tokens that can be minted. This cap should be a predefined constant or a variable that can be adjusted through governance mechanisms.

  • Burn Limit: Establish a limit on the amount of tokens that can be burned, either as a percentage of the total supply or as a fixed maximum amount.

// SPDX-License-Identifier: MIT
pragma solidity 0.8.22;
​
import {ERC20} from "@solmate/src/tokens/ERC20.sol";
​
contract SantaToken is ERC20 {
error SantaToken__NotSantasList();
error SantaToken__MintLimitExceeded();
error SantaToken__BurnLimitExceeded();
​
uint8 private constant DECIMALS = 18;
address private immutable i_santasList;
uint256 public constant MAX_SUPPLY = 1e24; // Example cap of 1 million tokens
​
constructor(address santasList) ERC20("SantaToken", "SANTA", DECIMALS) {
i_santasList = santasList;
}
​
function mint(address to, uint256 amount) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
if (totalSupply() + amount > MAX_SUPPLY) {
revert SantaToken__MintLimitExceeded();
}
_mint(to, amount);
}
​
function burn(address from, uint256 amount) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
if (balanceOf(from) < amount) {
revert SantaToken__BurnLimitExceeded();
}
_burn(from, amount);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.