# Zeta Supply Inflation on Deploy Fungible Gas Coin

Deploying a gas ZRC20 via DeployFungibleCoinZRC20 mints new azeta in SetupChainGasCoinAndPool without burning elsewhere, inflating ZETA supply and creating unbacked ZRC20 tokens.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: ChristiansWhoHack
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/339
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-24
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:go technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** Cosmos SDK fungible module msg server (DeployFungibleCoinZRC20 / SetupChainGasCoinAndPool)
**Root cause:** SetupChainGasCoinAndPool calls bankkeeper MintCoins() when creating the gas coin pool, increasing azeta supply without a corresponding burn or transfer from another chain, breaking the cross-chain constant-supply invariant.
**Steps:**
1. Add PoC test to `x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20_test.go`
2. Set admin policies via `setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)` and deploy system contracts
3. Record `sdkk.BankKeeper.GetSupply(ctx, "azeta")` before
4. Call `msgServer.DeployFungibleCoinZRC20` with `common.CoinType_Gas`
5. Observe azeta supply increased with no corresponding decrease elsewhere
**How found:** Read whitepaper section 7.3 on defense against arbitrary minting and the zeta_supply_checker invariant, then traced the DeployFungibleCoinZRC20 path into SetupChainGasCoinAndPool and spotted the MintCoins call with no offsetting burn.
**Exploitation:** Requires admin/group2 policy to submit DeployFungibleCoinZRC20 for a new chain's gas token; the call mints azeta and ZRC20 tokens not backed by TSS funds, inflating supply. Not attacker-reachable without admin privileges.
**Insight:** When a protocol documents a supply-conservation invariant and ships a checker for it, grep every mint/burn call site reachable from privileged message handlers and verify each mint has a matching source of funds; admin-gated paths still count as invariant breaks.