The ERC20ControlerMinterUpgradeable contract enforces blacklist restrictions for transfers, including admin-initiated force transfers, but fails to enforce these same restrictions during token minting in the mint() function. This inconsistency allows blacklisted addresses to receive tokens through minting, bypassing the intended restrictions.
This creates a security gap where tokens can still reach blacklisted addresses through the minting process, undermining the entire purpose of the blacklist mechanism.
The following changes are recommended to Token.sol:
