Submission Details
Severity:
Unrestricted Token Minting in `ZENO::mint`
Summary
The ZENO::mint function allows unrestricted token minting, bypassing the intended auction::state.totalRemaining safeguards. During deployment, if the ZENO contract is deployed first (where the owner is an Externally Owned Account, EOA), the owner can mint unlimited tokens to themselves before transferring ownership to the Auction contract.
Vulnerability Details
function mint(address to, uint256 amount) external onlyOwner { <==@found
if (amount == 0) {
revert ZeroAmount();
}
_mint(to, amount);
totalZENOMinted += amount;
}
Impact
Token Inflation: The owner can mint unlimited tokens, violating the intended tokenomics.
Protocol Integrity Failure: Undermines trust in the system’s supply controls.
Tools Used
Manual Review
Recommendations
Add a hard cap to the total mintable tokens.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.