First suggested minter will bypass all checks because totalSupply() is zero. This is rare case and may not lead to problem because the deployer will execute as soon as possible the function suggestMinter and will try to mint new tokens. In test cases I saw that they wait for 1 block and after that they mint new tokens https://github.com/code-423n4/2023-04-frankencoin/blob/main/test/PluginVetoTests.ts#L31
It has change for malicious user to look in mempool and to send transaction to add your minter before minting of new tokens to happens. The newly added minter can not be removed in the future. This can lead to unexpected behaviour.
Lines of code
https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Frankencoin.sol#L84
Vulnerability details
Impact
First suggested minter will bypass all checks because
totalSupply()
is zero. This is rare case and may not lead to problem because the deployer will execute as soon as possible the functionsuggestMinter
and will try to mint new tokens. In test cases I saw that they wait for 1 block and after that they mint new tokens https://github.com/code-423n4/2023-04-frankencoin/blob/main/test/PluginVetoTests.ts#L31It has change for malicious user to look in mempool and to send transaction to add your minter before minting of new tokens to happens. The newly added minter can not be removed in the future. This can lead to unexpected behaviour.
Proof of Concept
Tools Used
Manual review
Recommended Mitigation Steps