RebateFi Hook
First Flight #53
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

mint Function Lacks Supply Cap

seenu1947

Root + Impact

Description

  • Normal Behavior:
    The mint function is intended to create new tokens and assign them to a specified address. Normally, minting should be limited by a maximum supply to prevent inflation and protect tokenomics.

  • Observed Issue:

    The current implementation allows the owner to mint an unlimited number of tokens:

  • Problems:

    1. No maximum supply → owner can mint infinite tokens.

    2. No validation for zero address or zero amount.

    3. No event emitted for tracking mint operations.

    4. Can severely dilute existing holders and manipulate market prices.

function mint(address to, uint256 amount) external onlyOwner {
_mint(to, amount); // No supply cap
}
​

Risk

Likelihood:

  • Only the owner can call mint, limiting exposure.

Misuse by a malicious or compromised owner could occur.

Impact:

  • Infinite minting can dilute token holders.

Could manipulate price in markets, breaking economic design.

  • No tracking of minted amounts reduces transparency and auditability.

Proof of Concept

// Owner mints unlimited tokens
mint(user, 1_000_000_000 * 10**18);
// Buggy code: totalSupply exceeds intended max supply without restriction
// Fixed code: reverts with "Exceeds maximum supply"
​
// Minting to zero address
mint(address(0), 100);
// Buggy code: silently fails or burns tokens
// Fixed code: reverts with "Cannot mint to zero address"
​
// Minting zero tokens
mint(user, 0);
// Buggy code: may pass silently
// Fixed code: reverts with "Amount must be greater than zero"
​

Recommended Mitigation

- _mint(to, amount);
+ require(to != address(0), "Cannot mint to zero address");
+ require(amount > 0, "Amount must be greater than zero");
+ require(totalSupply() + amount <= MAX_SUPPLY, "Exceeds maximum supply");
+ _mint(to, amount);
+ emit TokensMinted(to, amount, totalSupply());
​
Updates

Lead Judging Commences

chaossr Lead Judge 12 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!