Submission Details
Severity:
`totalZENOMinted` is not being updated when tokens are burned
Summary
`totalZENOMinted` don't show the current amount of tokens in circulation
Vulnerability Details
the global variable `totalZENOMinted` is not decreasing when tokens are burned, users might think all tokens ever minted are still in circulation since this variable is kind of vague, when burned the variable doesnt decrease as it would make more sense since they no longer exist.
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/zeno/ZENO.sol#L20-L29
function redeem(uint amount) external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
if (amount == 0) {
revert ZeroAmount();
}
uint256 totalAmount = balanceOf(msg.sender);
if (amount > totalAmount) {
revert InsufficientBalance();
}
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount);
}
function redeemAll() external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
uint256 amount = balanceOf(msg.sender);
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount);
}
Impact
tokens burned are not decreased from minted ones.
Tools Used
manual
Recommendations
either decrease minted tokens or add a global variable for burned ones.
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.