Minting is completely impossible due to wrongful forking of convex

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L101

Vulnerability details

Impact

Minting through the mint function of the Aura token is impossible due to a wrongful fork of the Cvx token. This would require a complete redeployment to revive functionality to the Aura token's mint function.

During each mint, the following calculation is made:

uint256 emissionsMinted = totalSupply() - EMISSIONS_MAX_SUPPLY - minterMinted;

However, initially, totalSupply() is either just the _amount parameter from the initializer, which is likely way lower than EMISSIONS_MAX_SUPPLY. This causes the aforementioned line of code on line 101 to underflow with almost a guarantee and will cause all dependencies on the mint function (which we assume are a lot) to not function.

Proof of Concept

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L101

To reproduce the issue: It suffices to deploy Aura and initialize it. Any call to mint will than underflow due to the arithmetic on line 101.

Tools Used

Manual analysis.

Recommended Mitigation Steps

Consider reverting to the original Convex token code for the mint function.

[0xMaharishi]

The deploySystem script always passes a value of 5e25 to the init fn, and the system therefore works as intended. However you are right in that there is room for a bug here if the deploy script is misconfigured. We should have the init fn hard coded to 50m

[0xMaharishi]

Again, the sensationalist language used in this report is way off. You can see in the deploy script that init is called with 5e25. We should have an explicit check to run this though.

[0xMaharishi]

I recommend this being a 0 or 1 severity. No funds can be touched and nothing back can really happen because its only a potential configuration issue

[dmvt]

I'm downgrading this to a gas issue because the impact of it happening would be that the sponsor would have to redeploy and waste gas. No funds are at risk.