# Alchemist can mint AlTokens above their assigned ceiling by calling lowerHasMinted()

Whitelisted alchemist can call lowerHasMinted() to decrement totalMinted, bypassing mintCeiling and minting unlimited AlTokens.

- Payout: Audit contest
- Severity: medium
- Program: Alchemix
- Found by: tintin
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-alchemix#m-01
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-alchemix%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AlchemicTokenV2Base.sol mint ceiling accounting
**Root cause:** lowerHasMinted() shares onlyWhitelisted permission with mint() and lets the caller arbitrarily reduce totalMinted[msg.sender], which is the sole value checked against mintCeiling.
**Steps:**
1. Call `lowerHasMinted(amount)` to reduce `totalMinted[msg.sender]` below the ceiling.
2. Call `mint(recipient, amount)`; the check `total > mintCeiling[msg.sender]` passes.
3. Repeat to mint up to total supply.
**How found:** Manual code review comparing permission levels of mint() and lowerHasMinted() in the same contract, noticing both are onlyWhitelisted and the ceiling check relies on totalMinted.
**Exploitation:** A whitelisted alchemist repeatedly calls lowerHasMinted() to reset their totalMinted counter, then mints beyond their assigned ceiling, inflating AlToken supply.
**Insight:** When a cap is enforced against a mutable per-account counter, check every function that can write that counter and whether it shares the same privilege as the capped action.