VTVL contest - GimelSec's results

Lines of code

https://github.com/code-423n4/2022-09-vtvl/blob/main/contracts/token/VariableSupplyERC20Token.sol#L40-L44

Vulnerability details

Impact

If mintableSupply is set in VariableSupplyERC20Token.contructor(), the token won’t allow minting over mintableSupply. However, mintableSupply will reduce after every minting. Once mintableSupply is reduced to zero, the token can be minted unlimitedly.

Proof of Concept

• mintableSupply is set to 100
• mint 50 tokens, then mintableSupply = 100 - 50 = 0
• mint 50 tokens again, then mintableSupply = 50 - 50 =0
• Now if(mintableSupply > 0) is not ture, the token can be minted unlimitedly

https://github.com/code-423n4/2022-09-vtvl/blob/main/contracts/token/VariableSupplyERC20Token.sol#L40-L44

    function mint(address account, uint256 amount) public onlyAdmin {
        require(account != address(0), "INVALID_ADDRESS");
        // If we're using maxSupply, we need to make sure we respect it
        // mintableSupply = 0 means mint at will
        if(mintableSupply > 0) {
            require(amount <= mintableSupply, "INVALID_AMOUNT");
            // We need to reduce the amount only if we're using the limit, if not just leave it be
            mintableSupply -= amount;
        }
        _mint(account, amount);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Don’t treat mintableSupply = 0 as mint at wil. Maybe use a flag like mintableUnlimited for unlimited supply.