Submission Details
Severity:
Missing Access Control on Mint Function
Description: The WinningToken::mint function in the WinningToken contract is only protected by onlyOwner , but there's no mechanism to prevent the owner from minting unlimited tokens.
Impact: The owner could mint an unlimited number of tokens, potentially devaluing the token and disrupting the game's economy.
Proof of Concept:
// Malicious owner could mint unlimited tokens
function exploitMint() external {
// As owner
winningToken.mint(attackerAddress, 1_000_000);
}
Recommended Mitigation:
// ... existing code ...
uint256 public constant MAX_SUPPLY = 1_000_000;
uint256 public totalSupply;
function mint(address to, uint256 amount) external onlyOwner {
require(totalSupply + amount <= MAX_SUPPLY, "Exceeds max supply");
totalSupply += amount;
_mint(to, amount);
}
// ... existing code ...
Rewards breakdown
nSLOC
349This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.