VTVL contest - cRat1st0s's results

Lines of code

https://github.com/code-423n4/2022-09-vtvl/blob/main/contracts/token/VariableSupplyERC20Token.sol#L36-L46

Vulnerability details

2022-09-vtl-code4rena Report

• 2022-09-vtl-code4rena Report
  • Files Description Table
  • High Report
  • Issues found
    • [H-01]: Limited supply can be surpassed in mint()
      • Impact
      • Code Affected
      • Mitigation
      • Tools used

Files Description Table

High Report

Issues found

[H-01]: Limited supply can be surpassed in mint()

Impact

In function mint there is the if-statement if(mintableSupply > 0), that based on the comment, is needed to make sure that maxSupply is respected. But, in some point, by subtracting the amount from mintableSupply the mintableSupply will be equal to zero. As a consequence, again based on the comment, when mintableSupply is equal to zero then this means mint at will. So, token that has a limited supply can be surpassed.

Code Affected

https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/token/VariableSupplyERC20Token.sol#L36-L46

    function mint(address account, uint256 amount) public onlyAdmin {
        require(account != address(0), "INVALID_ADDRESS");
        // If we're using maxSupply, we need to make sure we respect it
        // mintableSupply = 0 means mint at will
        if(mintableSupply > 0) {
            require(amount <= mintableSupply, "INVALID_AMOUNT");
            // We need to reduce the amount only if we're using the limit, if not just leave it be
            mintableSupply -= amount;
        }
        _mint(account, amount);
    }

Mitigation

Check with maxSupply to verify that limited supply can not be surpassed.

Tools used

VS Code