Lines of code

Vulnerability details

Impact

When minting the tokens in VariableSupplyERC20Token the mintableSupply is reduced, thus you can bypass the max supply limit once it hits 0 because 0 means unlimited. As far as I understand, the total supply should never reach the cap set in the constructor (parameter maxSupply_).

Proof of Concept

  function mint(address account, uint256 amount) public onlyAdmin {
      require(account != address(0), "INVALID_ADDRESS");
      // If we're using maxSupply, we need to make sure we respect it
      // mintableSupply = 0 means mint at will
      if(mintableSupply > 0) {
          require(amount <= mintableSupply, "INVALID_AMOUNT");
          // We need to reduce the amount only if we're using the limit, if not just leave it be
          mintableSupply -= amount;
      }
      _mint(account, amount);
  }

Steps:

1. Mint mintableSupply.
2. mintableSupply is reduced to 0.
3. Mint any amount.

Recommended Mitigation Steps

Recommendation: rename mintableSupply to maxSupply (0 meaning unlimited). Do not decrement it here and before performing the mint check that maxSupply == 0 || totalSupply() + amount <= maxSupply.

The text was updated successfully, but these errors were encountered:

All reactions