# Self transfer can lead to unlimited mint

Self-transfer in Notional nToken transfer logic flips a negative incentive amount positive, letting an attacker mint unlimited nTokens.

- Payout: Audit contest
- Severity: high
- Program: Notional
- Found by: Omik
- Disclosed: 2021-10-01
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-08-notional-findings/issues/1
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** nTokenAction.sol transfer / nTokenERC20Proxy
**Root cause:** Transfer logic computes a signed incentive amount; when sender==recipient the negative adjustment at L278 is overwritten to positive at L279, finalizing a positive mint instead of zero.
**Steps:**
1. Call transfer via nTokenERC20Proxy with sender == recipient
2. Observe L278 sets amount negative for incentive accounting
3. L279 reassigns amount to non-negative value
4. L281-282 finalizes positive value, minting nTokens to self
**How found:** Noticed the transfer implementation deviates from standard ERC20 due to incentive accounting, then traced the signed amount handling across L278-282 and realized self-transfer breaks the negative-to-positive logic.
**Exploitation:** Attacker calls the nToken transfer function with themselves as both sender and recipient through nTokenERC20Proxy, causing the incentive accounting to credit a positive amount and mint unlimited nTokens.
**Insight:** When a token transfer embeds reward/incentive accounting with signed deltas, test sender==recipient and zero-amount transfers; branches that negate then reassign an amount can flip sign and mint.