VTVL contest - Soosh's results

Lines of code

https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/token/VariableSupplyERC20Token.sol#L40

Vulnerability details

Maximum supply is not enforced

In VariableSupplyERC20Token, the maximum supply is meant to cap minting over the specified amount.

function mint(address account, uint256 amount) public onlyAdmin {
        require(account != address(0), "INVALID_ADDRESS");
        // If we're using maxSupply, we need to make sure we respect it
        // mintableSupply = 0 means mint at will
        if(mintableSupply > 0) {
            require(amount <= mintableSupply, "INVALID_AMOUNT");
            // We need to reduce the amount only if we're using the limit, if not just leave it be
            mintableSupply -= amount;
        }
        _mint(account, amount);
    }

Projects which set maxSupply (mintableSupply) can actually mint more than the maxSupply since after they have minted the full mintableSupply, mintableSupply = 0, the if check will be false and amount will still be _mint().

Recommendations

Instead of this if check, Projects that do not want a maximum supply should set the mintableSupply to type(uint).max since it is the largest possible value for uint values in solidity. Alternatively, a new variable bool unlimitedSupply could be added for checking if the project wants an unlimited supply.

Affected Code:

https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/token/VariableSupplyERC20Token.sol#L40