Root + Impact

Description

The _burn function uses the Yul sub opcode to decrease the _totalSupply and the account's balance without first checking if the balance is greater than or equal to the amount being burned.

Risk

An attacker with a zero balance can call a function that triggers _burn with a positive value. The Yul sub operation will cause the balance to underflow (e.g., 0 - 1 results in 2^256 - 1), effectively granting the attacker the maximum possible token balance. This allows for unauthorized, arbitrary token creation, leading to the complete collapse of the token's economic value.

Proof of Concept

The _burn function uses the Yul sub opcode to decrease the _totalSupply and the account's balance without first checking if the balance is greater than or equal to the amount being burned.

Recommended Mitigation