# A well financed attacker could prevent any other users from minting synthetic tokens

Alchemix mint limiter only decrements on mint and never restores on burn, letting a flash-loan-funded attacker cycle mint/burn to pin the limit and block all other users from minting synthetic tokens.

- Payout: Audit contest
- Severity: medium
- Program: Alchemix
- Found by: dirky_
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-alchemix#m-14
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-alchemix%3AM-14
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** AlchemistV2 mint limiter (LinearGrowthLimiter)
**Root cause:** The LinearGrowthLimiter's mint limit is decremented on every mint but never incremented on burn, so burning debt does not restore minting capacity.
**Steps:**
1. Attacker obtains large capital, e.g. via flash loan.
2. Call `deposit` to post collateral in AlchemistV2.
3. Call `mint` to consume the entire current mint limit (Limiters.sol#L84 check).
4. Call `burn` to repay the synthetic debt; the debt position updates but the limiter is not restored.
5. Repeat `mint`/`burn` in a loop, timed to keep the limiter pegged at its maximum.
6. Legitimate users' `mint` calls revert against the exhausted limit.
**How found:** Reading the mint path, the researcher noticed `_mint` decreases the limiter but nothing on the burn path increases it, and that debt updates on burn allow re-minting against the same collateral.
**Exploitation:** Flash loan -> deposit -> mint -> burn -> repay flash loan, repeated to keep the mint limit saturated so no other user can mint synthetic tokens. No funds stolen; protocol functionality denied.
**Insight:** When a rate/limit limiter gates an action, check whether the inverse action (burn/withdraw/repay) restores the budget; if not, cheap mint/burn cycling can permanently saturate the limit and grief all users.