Submission Details
Impact:
Likelihood:
BriTechLabs token is uncapped, leading to possible rug by owner
Owner can mint more tokens, leading to possible rug by owner
Description
-
Owner can call
mint()multiple times. If the token can be traded for money, the value of the token held by players can decrease dramatically.
function mint() public onlyOwner {
_mint(owner(), 10_000_000 * 1e18);
}
Risk
Likelihood:
Whenever owner calls
mint()
Impact:
If the token can be traded for money, the value of the token held by players can decrease dramatically when owner calls
mint()multiple times.
Proof of Concept
// SPDX-License-Identifier: MIT
import {Test} from "forge-std/Test.sol";
import {BriTechToken} from "../src/briTechToken.sol";
contract BriTechTokenTest is Test {
BriTechToken public briToken;
// Users
address owner;
address user1 = makeAddr("user1");
function setUp() public {
// The constructor sets msg.sender as the owner
// so we can just create the contract and the deployer will be the owner.
briToken = new BriTechToken();
owner = briToken.owner();
}
function test_uncappedMinting() public {
uint256 mintAmount = 10_000_000 * 1e18;
// Initial state: total supply is 0
assertEq(briToken.totalSupply(), 0, "Initial total supply should be 0");
vm.startPrank(owner);
// First mint
briToken.mint();
assertEq(briToken.totalSupply(), mintAmount, "Total supply should be mintAmount after first mint");
assertEq(briToken.balanceOf(owner), mintAmount, "Owner balance should be mintAmount after first mint");
// Second mint, showing the mint supply is uncapped.
briToken.mint();
assertEq(briToken.totalSupply(), mintAmount * 2, "Total supply should be 2 * mintAmount after second mint");
assertEq(briToken.balanceOf(owner), mintAmount * 2, "Owner balance should be 2 * mintAmount after second mint");
vm.stopPrank();
}
Recommended Mitigation
+ constructor() ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {
+ _mint(msg.sender, 10_000_000 * 1e18);
+ }
- constructor() ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {}
-
- function mint() public onlyOwner {
- _mint(owner(), 10_000_000 * 1e18);
- }
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.