Submission Details
Severity:
Anyone can mint IndexToken
Summary
In IndexToken.sol anyone can call mint and mint infinite amount of tokens to himself
Vulnerability Details
No access management on mint leads to anyone be able to call it
contract IndexToken is ERC20 {
constructor(string memory name, string memory symbol) ERC20(name, symbol) {}
error InvalidAddress();
function mint(address to, uint256 amount) external {
if (to == address(0)) revert InvalidAddress();
_mint(to, amount);
}
}
Impact
Any user can mint himself tokens
Tools Used
manual review
Recommendations
add access control
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.