Raisebox Faucet
First Flight #50
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Unbounded Token Minting in `mintFaucetTokens`

ambitiousdydx

Description

The mintFaucetTokens function allows the owner to mint arbitrary amounts of tokens to the contract, with only a check that the contract’s balance is below 1000 * 10**18. This weak constraint allows excessive minting, potentially inflating the token supply beyond intended limits.

// Root cause in the codebase with @> marks to highlight the relevant section
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}
@>if (balanceOf(address(to)) > 1000 * 10 ** 18) {
@> revert RaiseBoxFaucet_FaucetNotOutOfTokens();
@>}
@>_mint(to, amount); // No upper limit on amount
}

Risk

Likelihood:

  • Occurs when the owner calls mintFaucetTokens with a large amount while the contract’s balance is below 1000 * 10**18.

  • Occurs only if the owner intentionally or accidentally mints excessive tokens.

Impact:

  • Excessive token minting inflates the supply, undermining the faucet’s purpose.

  • Could disrupt the future protocol’s testnet, as tokens are intended for specific interactions.

Proof of Concept

Explanation: The PoC shows how the owner can mint an excessively large number of tokens as long as the contract’s balance is below the threshold. This inflates the total supply, potentially disrupting the faucet’s intended use in the testnet.

function testExcessiveMinting(RaiseBoxFaucet faucet) public {
// Contract balance is 500 * 10**18 (below 1000 * 10**18)
vm.prank(faucet.getOwner());
faucet.mintFaucetTokens(address(faucet), 10_000_000_000 * 10**18); // Mints massive amount
// Total supply now inflated significantly
}

Recommended Mitigation

Explanation: We introduce a MAX_SUPPLY constant to cap the total token supply. A check ensures that minting does not exceed this cap, preventing excessive inflation while maintaining the existing balance threshold check.

+ uint256 public constant MAX_SUPPLY = 10_000_000_000 * 10 ** 18;
​
function mintFaucetTokens(address to, uint256 amount) public onlyOwner {
if (to != address(this)) {
revert RaiseBoxFaucet_MiningToNonContractAddressFailed();
}
if (balanceOf(address(to)) > 1000 * 10 ** 18) {
revert RaiseBoxFaucet_FaucetNotOutOfTokens();
}
+ if (totalSupply() + amount > MAX_SUPPLY) {
+ revert("Minting exceeds maximum supply");
+ }
_mint(to, amount);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.