Summary

TempleGold has a MAX_SUPPLY variable which limits the max supply of the token, when mint is called, the amount mintable is determined by timelapsed since last mint. However, the formula uses timestamp instead of block number, which can cause max supply to be reach in a short time span.

Vulnerability Details

In mint function of TempleGold, we can see that the mintable amount is calculated in _getMintAmount:

To follow up, we see the mintable amount is determined by current timestamp, lastMintTimestamp, and numerator, and denominator set in the vesting factor:

For a better, the formula can be written as: (block.timestamp - _lastMintTimestamp) * MAX_SUPPLY * (numerator / denominator). According to the factor params set in the test files, we can see the numerator and denominator is set to 2e18 and 1000e18 respectively:

With those as presumption, the formula then becomes: timeDiff * MAX_SUPPLY * 2 / 1000, as the ether will cancel out. Which means, when (block.timestamp - _lastMintTimestamp) * 2 / 1000 reaches 1, max supply can be reached, and this makes the max time difference to be about 500 seconds, which is less than 10 minutes, and 41 blocks if we take block time as 12 seconds each.

The issue here is to use block.timestamp as one of the factor, making the calculated value to rise rapidly. Since in the test files, the factor is set to 2 / 1000, so I assume this will be a reasonable scale considered by the protocol team. If such factor is set in deployment, all TempleGold tokens can be minted quickly, and reaches max supply in a short time span.

Impact

Max supply can be met rapidly, causing users not have enough time to vest or react to. And potentially break the function of this token.

Tools Used

Manual review

Recommendations

Consider use block number, or add a limit for numerators, as when numerators is reasonablely small, the mintable amount can still grow at an insane rate.