Incorrect initial mint will break the contract

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L71

Vulnerability details

Impact

It was observed that if initial mint via init function becomes < EMISSIONS_MAX_SUPPLY then mint function will always fail due to totalSupply()<EMISSIONS_MAX_SUPPLY (failing Aura.sol#L101)

Proof of Concept

1. Owner calls the init function and provide amount as 100
2. totalSupply becomes 100
3. Operator now calls the mint function
4. mint function fails since totalSupply()<EMISSIONS_MAX_SUPPLY

uint256 emissionsMinted = totalSupply() - EMISSIONS_MAX_SUPPLY - minterMinted;

Recommended Mitigation Steps

The init function should call _mint function with amount as EMISSIONS_MAX_SUPPLY or more.

uint256 public constant EMISSIONS_MAX_SUPPLY = 5e25; // 50m
uint256 public constant INIT_SUPPLY = 5e25; // 50m

function init(
        address _to,
        address _minter
    ) external {
        ...

        _mint(_to, INIT_SUPPLY);
        ...
    }

[0xMaharishi]

Valid report, however given that the deploySystem script always runs with > 5e25, there is no immediate cause for concern. To make the contract more robust we can add some protections. Duplicate of #97 although i think this issue is much better

[dmvt]

As with #97, this is a gas issue. The full impact of this happening would be that the team would need to redeploy the contract.

[dmvt]

Grouping this with the warden’s gas report, #129