TempleGold

TempleDAO
Foundry
25,000 USDC
View results
Submission Details
Severity: low
Invalid

Lack of Total Supply Check in `_canDistribute` Function of `TempleGold` Contract

Summary

The _canDistribute function in the TempleGold contract lacks a check for the total supply limit, potentially allowing the minting of tokens beyond the maximum supply (MAX_SUPPLY).

Vulnerability Details

The _canDistribute function determines whether a specified amount of tokens (mintAmount) can be distributed based on the current conditions. However, it fails to include a validation step to ensure that minting additional tokens does not exceed the maximum supply (MAX_SUPPLY).

  • The function checks if mintAmount meets a minimum mint requirement (MINIMUM_MINT) but does not verify if _totalDistributed + mintAmount exceeds MAX_SUPPLY.

  • Without this check, there is a risk of minting tokens beyond the maximum limit, leading to potential overflow issues or invalid states in the contract.

See the following code:

function _canDistribute(uint256 mintAmount) private view returns (bool) {
return mintAmount != 0 && _totalDistributed + mintAmount == MAX_SUPPLY ? true : mintAmount >= MINIMUM_MINT;
}

Impact

Minting tokens beyond MAX_SUPPLY can lead to arithmetic overflow issues, disrupting contract operations and affecting token balances. Exceeding the maximum supply can compromise the integrity of the TempleGold contract, potentially requiring manual intervention to correct. Violating maximum supply constraints may lead to non-compliance with regulatory standards or audit requirements.

Tools Used

Manual Review

Recommendations

Modify _canDistribute to include a check ensuring that _totalDistributed + mintAmount does not exceed MAX_SUPPLY.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

`_canDistribute` could return a result breaking the MAX TOTAL SUPPLY of TGLD

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.