The ERC20ControlerMinterUpgradeable::updateMintingAllowance() function is vulnerable to front-running attacks, similar to the classic ERC20 approved front-running issue. A minter could detect an incoming allowance reduction and quickly consume their current allowance before its reduced.
The current implementation directly overwrites the minting allowance without any protection:
This creates a race condition where:
The impact is considered Medium because:
Add the following unit tests to Token.js:
Implement a safe allowance update mechanism similar to ERC20s increaseAllowance/decreaseAllowance:
0xsomeone (judge) commented:
