Submitted by tintin, also found by 0xsomeone, AuditsAreUS, and hyh
AlchemicTokenV2Base.sol#L111-L124
AlchemicTokenV2Base.sol#L189-L191
An alchemist / user can mint more than their alloted amount of AlTokens by calling lowerHasMinted() before they reach their minting cap.
Function mint() in AlchemicTokenV2Base.sol
Note the require conditional check that total > mintCeiling[msg.sender].
In the same contract, there is the function lowerHasMinted() with the same permission level as mint and is thus callable by the same user as well.
It is clear that a user can accumulate an infinite (within supply) amount of AlTokens by calling lowerHasMinted() before any action that would make them exceed their minting cap.
Manual review, VScode
Change the permissioning on lowerHasMinted() to be restricted to a higher permissioned role like onlySentinel() , or deprecate this function as I could not find any uses of it throughout the codebase or in tests.
0xfoobar (Alchemix) confirmed
0xleastwood (judge) commented:
