Rock Paper Scissors

First Flight #38
Beginner FriendlySolidity
100 EXP
View results
Submission Details
Severity: medium
Invalid

Unlimited Minting Without Maximum Supply

Unlimited Minting Without Maximum Supply

Summary

The WinningToken contract allows the owner to mint an arbitrary number of tokens without any cap or upper limit. This centralization of control and lack of supply constraints can lead to trust issues and potential abuse, particularly if the token is used within or beyond the context of a game.

Vulnerability Details

The contract includes a mint function restricted to the contract owner:

function mint(address to, uint256 amount) external onlyOwner {
_mint(to, amount);
}

However, there is no restriction on the total supply of tokens that can be minted. This means the owner can continuously mint new tokens, leading to an inflationary supply model with no control or accountability.

This is especially relevant for tokens intended to have a fixed or deflationary model, or when users expect a capped token economy based on scarcity.

Impact

Trust Risk: Users and integrators may lose trust in the token due to centralized control over supply.

Inflation Risk: Unlimited minting could devalue existing tokens and disrupt game mechanics or market economics.

DeFi Interactions: If this token is used in DeFi protocols, such minting authority could be abused to drain liquidity pools or manipulate governance.

Tools Used

Manual code review

Recommendations

Implement a maximum supply constraint to enforce a hard cap

Updates

Appeal created

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational

Code suggestions or observations that do not pose a direct security risk.

m3dython Lead Judge 2 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational

Code suggestions or observations that do not pose a direct security risk.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.