Submission Details
Severity:
Max mintable amount not set in RAACToken making values in RAACReleaseOrchestrator.sol meaningless
Summary
In the RAACReleaseOrchestrator there are limits on how much of RAACTokens are supplied to different users. These are defined as percentages. But since the RAACToken can be minted infinitely, these percentages dont make any sense.
Vulnerability Details
It can be seen that there is no limit on the number of RAAC tokens mintable.
function mint(address to, uint256 amount) external onlyMinter {
if (to == address(0)) revert InvalidAddress();
_mint(to, amount);
}
Furhter the documentation provides a percentages which means they expect a maximum number of RAACTokens in circulation.
(RAACReleaseOrchestrator)
Impact
Unlimited minting of RAACTokens.
Tools Used
manual review
Recommendations
keep a limit on the maximum amount in totalSupply.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.