# CGT: governance spell abuse mints unlimited tokens

CGT token's MakerDAO-style chief/pause governance was abused to mint unlimited CGT via a malicious spell, then dumped across DEXes for ~998B tokens.

- Payout: Real-world hack
- Severity: critical
- Program: CGT
- Analysis by: DeFiHackLabs
- Disclosed: 2024-03-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-03/CGT_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20240323-cgt
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** ERC20 token governance (DSChief/DSPause) and DEX routers
**Root cause:** The token's DSChief/DSPause governance allowed an attacker to lock a small amount of CGT, vote themselves in, and lift themselves to schedule/execute an arbitrary spell that called a mint-like act() on the token.
**Steps:**
1. `cgt.approve(chief, max); chief.lock(20 ether)`
2. `chief.vote([self]); chief.lift(self)` to gain authority
3. Deploy malicious `Spell` contract with `act(address,address)`
4. `pause.plot(spell, extcodehash(spell), sig, now)` then `pause.exec(...)` to execute the spell
5. Spell mints ~10^8 * 1e18 CGT to attacker
6. Swap minted CGT for WETH/DAI/XCHF/OINCH/UNI/LINK/SKL/IXS via Uniswap V2 and V3 routers
**Exploitation:** Attacker locked 20 CGT into DSChief, voted for self, lifted self to gain spell-scheduling authority, then plotted and immediately executed a malicious spell (delay=0) that minted ~10^8 CGT to the attacker. The minted tokens were then swapped through Uniswap V2 and V3 pools for WETH, DAI, and other assets, draining pool liquidity.
**Escalation:** Minted amount (~10^8 * 1e18) vastly exceeded real supply, letting attacker drain multiple DEX pools across many token pairs.
**Insight:** Forked MakerDAO governance (DSChief/DSPause) on a token contract is a red flag: if lift/plot/exec are reachable with a tiny stake and zero delay, an attacker can schedule a spell that calls privileged mint/act functions. Check `delay` and vote thresholds on any DSChief clone.