BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Lack of Mint Event Emission — No Transparency for Token Supply Changes

minionteechs

Root + Impact

Description

  • Normal behavior:
    When tokens are minted or burned, projects should emit custom events (beyond the standard Transfer event) to improve transparency for users, auditors, and indexers (e.g., The Graph, Etherscan, Dune).

Issue:
The BriTechToken contract’s mint() function does not emit any custom event when new tokens are minted.
While the underlying ERC20 _mint() triggers a standard Transfer event, it doesn’t provide contextual clarity (e.g., reason, round, or timestamp of mint), making it difficult to audit or track new supply creation on-chain.

// Root cause in the codebase with @> marks to highlight the relevant section
@> function mint() public onlyOwner {
@> _mint(owner(), 10_000_000 * 1e18); // No Minted event emitted
@> }
​

Risk

Likelihood:

  • This occurs every time mint() is called since no event logs additional context about the new supply.

It also occurs when off-chain dashboards or explorers query the contract and fail to differentiate between user transfers and administrative minting.

Impact:

  • Reduced transparency — Users, auditors, and third-party analytics platforms cannot easily verify mint activity.

Potential for misuse concealment — Malicious or excessive minting may go unnoticed in real-time monitoring tools.

Proof of Concept

Explanation:
The only log recorded is the ERC20 Transfer from address(0), which lacks project-specific context about the mint.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
contract MintTransparencyTest {
event Minted(address indexed to, uint256 amount);
​
function testMint(address token) external {
BriTechToken(token).mint();
// No Minted event in logs — only a Transfer(0x0 -> owner) detected
}
}
​

Recommended Mitigation

Emit a Minted event in the mint() function to improve on-chain traceability.

Explanation:
Emitting a custom Minted event ensures supply transparency, allowing analytics dashboards, explorers, and users to easily monitor mint actions in real time.

- remove this code
+ add this code
+ event Minted(address indexed to, uint256 amount);
​
- function mint() public onlyOwner {
- _mint(owner(), 10_000_000 * 1e18);
- }
​
+ function mint() public onlyOwner {
+ uint256 amount = 10_000_000 * 1e18;
+ _mint(owner(), amount);
+ emit Minted(owner(), amount);
+ }
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!