BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

BriTechToken Unlimited Minting

yxsec

Description

  • Utility tokens typically enforce caps or governance-controlled minting.

  • BriTechToken lets the owner call mint() indefinitely, though this token currently isn’t used by BriVault.

// src/briTechToken.sol:7-12
function mint() public onlyOwner {
@> _mint(owner(), 10_000_000 * 1e18); // no cap
}

Risk

Likelihood:

  • Only occurs when the owner explicitly calls mint().

  • No external trigger; requires malicious or mistaken owner action.

Impact:

  • If the token later backs the vault, the owner could dilute supply arbitrarily.

  • In the current codebase it has no direct effect but should be documented.

Proof of Concept

token.mint(); // supply +10M
token.mint(); // supply +10M again

Recommended Mitigation

+ bool public minted;
function mint() public onlyOwner {
+ require(!minted, "already minted");
_mint(owner(), 10_000_000 * 1e18);
+ minted = true;
}
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!