# RateLimitedMinter isn't used by SimplePSM resulting in Governance attacks

SimplePSM mints gUSDC without RateLimitedMinter caps, letting a large USDC holder cheaply reach veto quorum and cancel governance actions.

- Payout: Contest reward
- Severity: medium
- Program: Ethereum Credit Guild
- Credited: critical-or-high
- Disclosed: 2024-02-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-ethereumcreditguild-findings/issues/335
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-ethereumcreditguild%3AM-21
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** SimplePSM / GuildVetoGovernor governance
**Root cause:** SimplePSM mints credit tokens without the RateLimitedMinter cap used elsewhere, so voting power can be acquired instantly with USDC; the veto quorum (5M gUSDC) can be reached at low cost and redeemed quickly before creditMultiplier drops.
**Steps:**
1. Attacker holds 6M USDC; approve SimplePSM and call `psm.mint(Alice, 6_000_000e6)` to receive 6M gUSDC (no rate limit).
2. `credit.delegate(Alice)` to activate voting power.
3. `vetoGovernor.createVeto(timelockId)` on a queued timelock action.
4. `vetoGovernor.castVote(proposalId, Against)` after a block.
5. `vetoGovernor.executeVeto(timelockId)` once againstVotes > quorum(0) (5M gUSDC).
6. Redeem USDC back via PSM before creditMultiplier declines.
**How found:** Noticed SimplePSM imports but never uses RateLimitedMinter, then reasoned that uncapped minting lets an attacker cheaply reach the GuildVetoGovernor quorum and wrote a Foundry PoC.
**Exploitation:** Attacker with sufficient USDC mints gUSDC in SimplePSM bypassing rate limits, delegates, creates and passes a veto proposal against a queued timelock action, then redeems USDC quickly so creditMultiplier is unaffected.
**Escalation:** Can veto/cancel any queued governance action in a market, halting updates at lower capital cost than intended quorum.
**Insight:** Check whether mint/burn paths that grant governance voting power enforce the same rate limits as other mint paths; uncapped mint-to-vote lets capital-rich actors cheaply hit quorum and veto, especially when the veto window is short enough to redeem before multiplier changes.