Submission Details
Impact:
Likelihood:
There is no restriction on the owner mint tokens, which leads to token inflation and a loss of user confidence.
There is no restriction on the owner minting tokens, which leads to token inflation and a loss of user confidence.
Description
The owner can mint any number of tokens without any restrictions, which leads to inflation and a significant drop in the token's value. Furthermore, there is no mechanism for burning tokens when needed.
// SPDX-License-Identifier: MIT
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
contract BriTechToken is ERC20, Ownable {
constructor() ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {}
@> function mint() public onlyOwner {
@> _mint(owner(), 10_000_000 * 1e18);
}
}
Risk
Likelihood:
It is unlikely to occur.
Impact:
Funds are indirectly at risk.
Proof of Concept
1. Make deploy to contract.
2. Try mint tokens More than once.
Put this test in `briVault.t.sol`.
```javascript
function testPrintBalanceFiveMints() public {
vm.startPrank(owner);
// Deploy a new MockERC20 token
MockERC20 token = new MockERC20("Mock Token", "MTK");
// Print the initial balance of the owner before any mint operation
console.log("Initial balance:", token.balanceOf(owner));
// Perform 5 mint operations and print the balance after each one
for (uint256 i = 0; i < 5; i++) {
// Mint 1 ether worth of tokens each time
token.mint(owner, 1 ether);
// Print the current mint iteration number
console.log("Mint #", i + 1);
// Print the balance after this mint
console.log("Balance after mint:", token.balanceOf(owner));
}
// Stop the prank (end impersonation of the owner)
vm.stopPrank();
}
```
Recommended Mitigation
1. Adding a method to the contract to allow burning tokens when needed.
```diff
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
contract BriTechToken is ERC20, Ownable {
constructor() ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {}
function mint() public onlyOwner {
_mint(owner(), 10_000_000 * 1e18);
}
+ function burn(uint256 amount) public onlyOwner {
+ _burn(owner(), amount);
+ }
}
```
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.