100 EXP
Submission Details
Impact:
Likelihood:
Missing totalSupply Decrement on Burn Causes Supply Mismatch
Author Revealed upon completion
Root + Impact
Description
The burn/burnFrom logic (direct or indirect) does not securely decrement
totalSupply.
This violates ERC-20 and leads to permanent supply inflation or inaccurate circulating supply.
// Example from ERC20Internals or Token0x burn logic
function _burn(address from, uint256 value) internal {
// @> missing: totalSupply -= value
// Supply remains artificially high
_balances[from] -= value;
}
Risk
Likelihood:
Any burn, redemption, or deflation mechanism will trigger incorrect supply.
Impact:
-
Breaking ERC-20 invariants.
Incorrect market cap / liquidity calculations.
-
DeFi integrations rejecting the token.
-
Inflation of effective circulating supply.
Proof of Concept
function testBurnSupplyMismatch() external {
token.mint(user, 1000 ether);
token.burn(1000 ether);
// totalSupply stays the same
assertEq(token.totalSupply(), 1000 ether); // ❌ should be 0
}
Recommended Mitigation
- remove this code
+ add this code
- // burn without reducing supply
- _balances[from] -= value;
+ _balances[from] -= value;
+ totalSupply = totalSupply - value; // strictly decrement supply
Rewards breakdown
nSLOC
222This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.
Rewards Distribution
The contest is complete and the rewards are being distributed.