# Anyone Can Mint CRT During Deployment

CRT CAT minting at deployment only checked concurrent spend, letting an attacker RBF the deployment bundle and mint a majority of CRT supply to themselves.

- Payout: Contest reward
- Severity: medium
- Program: Circuit Puzzles
- Credited: yakuhito
- Disclosed: 2025-08-21
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_circuit_puzzles.pdf#3.3.7
- Library page: https://bugbountylibrary.com/r/cantina%3Acircuit_puzzles%3A3.3.7
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:governance

**Target:** Chia custom CAT (CRT) TAIL puzzle / deployment spend bundle
**Root cause:** Deployment minting is gated only by ASSERT_CONCURRENT_SPEND, which enforces same-block minting but not which coin may mint CRT, so any coin can be attached to the deployment bundle.
**Steps:**
1. Monitor Chia mempool for the deployment bundle; parse coin spends and identify CRT asset by its TAIL mod.
2. Attach two extra spends to the bundle: one minting 50.1% of new CRT supply to attacker address, one raising the transaction fee.
3. Submit the modified bundle; Chia Replace-by-Fee replaces the original in mempool.
4. After confirmation, attacker holds majority CRT supply and thus governance control.
**How found:** Code review of crt_tail.clsp line 135: noticed ASSERT_CONCURRENT_SPEND constrains timing but not the minting coin's identity, then reasoned about mempool visibility and Chia's RBF mechanism (used in TibetSwap/warp.green) to weaponize it.
**Exploitation:** Attacker watches mempool for deployment, appends a mint spend to their own address plus a higher fee, and uses Chia RBF to replace the pending deployment bundle; cost ~1.01 XCH + fees to mint 1.01B CRT against a 1B supply, gaining governance majority.
**Escalation:** Majority CRT supply yields full governance control over the protocol; alternatively a cheap mint (0.1 XCH for 100M CRT) can invalidate the deployment as a DOS.
**Insight:** When a puzzle gates minting only by concurrent-spend timing, check whether the minting coin's parent/ID is constrained; mempool-visible deployment bundles on RBF-capable chains let anyone splice in their own mint spend.