VTVL contest - Franfran's results

Lines of code

https://github.com/code-423n4/2022-09-vtvl/blob/main/contracts/token/VariableSupplyERC20Token.sol#L40

Vulnerability details

Impact

The owner of the VariableSupplyERC20Token can mint an infinite amount of tokens, even if it was deployed as a "fixed supply" ERC20 token because of a wrong logic in the contract.

Proof of Concept

In order to do this, just create a contract with a fixed supply (with maxSupply_ > 0) Then mint some tokens to reduce mintableSupply to 0 (So minting mintableSupply) Now the if(mintableSupply > 0) { is never reached because mintableSupply is 0.

//SPDX-License-Identifier: Unlicense
pragma solidity 0.8.14;

import "../../contracts/token/VariableSupplyERC20Token.sol";

import "forge-std/Test.sol";

contract VariableToken is Test {
    VariableSupplyERC20Token t;
    
    uint maxSupply = 1_000_000 ether;

    function setUp() public {
        t = new VariableSupplyERC20Token("TEST", "TestToken", 0, maxSupply);
    }
    
    function testInfinite() public {
        assertEq(t.mintableSupply(), maxSupply);

        t.mint(address(this), maxSupply);

        assertEq(t.balanceOf(address(this)), maxSupply);
        assertEq(t.mintableSupply(), 0);
        
        uint256 bigAmount = 1_234_567 ether;
        t.mint(address(this), bigAmount);
        assertEq(t.balanceOf(address(this)), maxSupply + bigAmount);
    }
}

Tools Used

helix

Recommended Mitigation Steps

Add a boolean that switches on or off the state of the contract supply, either variable or infinite, that could look like that:

bool public isVariable;

constructor(string memory name_, string memory symbol_, uint256 initialSupply_, uint256 maxSupply_) ERC20(name_, symbol_) {
        require(initialSupply_ > 0 || maxSupply_ > 0, "INVALID_AMOUNT");

        if (maxSupply_ > 0) {
                isVariable = true;
                mintableSupply = maxSupply_;
        }
        
        if(initialSupply_ > 0) {
            mint(_msgSender(), initialSupply_);
        }
    }

And then add a check in the mint() function

if(mintableSupply > 0 && isVariable) {
      ....
}