BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Unbounded Repeated Mint Calls with Fixed Amount (Economic Inefficiency)

minionteechs

Root + Impact

Description

  • Normal behavior:
    A mint function should typically allow a variable mint amount or enforce a maximum supply, ensuring flexibility and efficiency in token issuance.

Issue:
The current mint() function always mints a fixed amount (10,000,000 * 1e18) each time it’s called.
This means the owner cannot mint partial amounts, and multiple calls will continuously create massive supply chunks — even if a smaller issuance is needed.
The design is both inefficient and economically unsafe, as a single accidental call could flood the token supply.

// Root cause in the codebase with @> marks to highlight the relevant section
@> function mint() public onlyOwner {
@> _mint(owner(), 10_000_000 * 1e18); // Fixed mint amount — no flexibility or cap
@> }
​

Risk

Likelihood:

  • This issue occurs whenever the owner executes mint() for operational reasons (airdrop, liquidity, or rewards).

It will also occur when external automation scripts trigger minting, resulting in massive over-minting due to fixed parameters.

Impact:

  • Economic inefficiency — unnecessary oversupply increases circulating tokens far beyond demand.

Systemic inflation risk — repeated minting floods markets, damages token value, and disrupts integrations expecting limited emissions.

Proof of Concept

Explanation:
Running this loop mints 10M tokens per call, creating massive oversupply with minimal effort.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
contract FixedMintExploit {
function floodToken(address token, uint256 times) external {
for (uint256 i = 0; i < times; i++) {
BriTechToken(token).mint();
// Each call mints 10M tokens — flooding total supply quickly
}
}
}
​

Recommended Mitigation

Allow dynamic minting with an enforced total cap to prevent over-minting.

Explanation:
This approach adds mint flexibility while ensuring strong economic boundaries, preventing accidental or malicious oversupply.

- remove this code
+ add this code
+ uint256 public constant MAX_SUPPLY = 10_000_000 * 1e18;
​
- function mint() public onlyOwner {
- _mint(owner(), 10_000_000 * 1e18);
- }
​
+ function mint(uint256 amount) external onlyOwner {
+ require(totalSupply() + amount <= MAX_SUPPLY, "Exceeds total supply cap");
+ _mint(owner(), amount);
+ }
​
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!