BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

No Timelock or Rate Limit on Minting — Temporal Control Risk

minionteechs

Root + Impact

Description

  • Normal behavior:
    Token minting should be rate-limited or timelocked, especially in production systems, to prevent sudden and excessive changes to supply.
    This ensures predictable inflation and gives the community or investors time to react to governance decisions.

Issue:
The mint() function can be called at any time, repeatedly, and without delay.
There’s no cooldown period or timelock between mint operations, allowing the owner (or a compromised owner wallet) to mint massive amounts in rapid succession — destabilizing the token’s price and ecosystem.

// Root cause in the codebase with @> marks to highlight the relevant section
@> function mint() public onlyOwner {
@> _mint(owner(), 10_000_000 * 1e18); // No rate limit or timelock
@> }
​

Risk

Likelihood:

  • This occurs whenever the owner performs consecutive mint operations in short time frames (e.g., automated or scripted minting).

It will also occur if an attacker compromises the owner account and performs rapid mints before detection.

Impact:

  • Severe inflation risk — the supply can spike uncontrollably in seconds.

Market manipulation risk — large, instant mints can be used to dump tokens on DEXs or manipulate price feeds.

Proof of Concept


Explanation:
By looping the mint() call, the attacker floods supply with millions of tokens in seconds, causing irreparable economic damage.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
​
contract RapidMintAttack {
function mintSpam(address token, uint256 times) external {
for (uint256 i = 0; i < times; i++) {
BriTechToken(token).mint();
// Each loop call mints instantly — no cooldown or delay
}
}
}
​

Recommended Mitigation

Introduce a timelock or mint cooldown to limit frequency of mint operations.

Explanation:
Enforcing a cooldown period between mints prevents inflation spikes, provides auditability, and improves ecosystem stability by giving time to respond before additional supply is introduced.

- remove this code
+ add this code
+ uint256 public lastMintTime;
+ uint256 public constant MINT_COOLDOWN = 1 days;
​
- function mint() public onlyOwner {
- _mint(owner(), 10_000_000 * 1e18);
- }
​
+ function mint(uint256 amount) external onlyOwner {
+ require(block.timestamp >= lastMintTime + MINT_COOLDOWN, "Mint cooldown active");
+ _mint(owner(), amount);
+ lastMintTime = block.timestamp;
+ }
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!