# Unbacked mint from spoofed value or entropy

Mint or reward paths that trust msg.value, log origin, or a shared index without proving real payment or reachability

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; one confirmed bounty: $6,000,000; latest 2024-09-13. Updated 2026-11-01._

## How it works
A mint or reward path credits value based on a signal that does not actually prove the value was paid or is reachable. The assumption that breaks: "msg.value > 0 means ETH moved" and "a log from the right address means a real deposit" and "the special index will be consumed before the cap." Each can be false. DELEGATECALL preserves the caller's msg.value without transferring ETH, so a precompile sees a nonzero value it never received [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md). A capped counter incremented by a second path can skip a shared randomness index [E2](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-06.md). An index range larger than the mintable cap strands the special value [E3](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-19.md).

## Where it shows up
- Precompiles or bridges that accept `msg.value > 0` or a log's emitting address as proof of payment [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md)
- Any code reachable via DELEGATECALL that reads msg.value or trusts caller context [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md)
- A supply counter incremented by more than one code path (mint, forge, burn) sharing one entropy/randomness index [E2](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-06.md)
- Random index ranges whose total capacity exceeds the per-generation mint cap [E3](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-19.md)
- Selection points computed from block number or other manipulable input without bounds against consumable slots [E3](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-19.md)

## How to review
For every credit path, ask what invariant proves the value is real. The property that must hold: value credited is backed by value actually received in this call, not inherited context. Check that payment is verified by an actual balance delta or transfer, not msg.value alone, and that log origin is not treated as payment proof [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md). For counters, verify every increment path also advances the shared index, and that the index space size equals the number of consumable entries [E2](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-06.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-19.md). Compare array capacity against the mint cap explicitly.

## Variants seen
- Inherited msg.value via DELEGATECALL minting unbacked tokens [E1](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md)
- Second increment path (forging) skipping the golden-god entropy slot [E2](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-06.md)
- Selection range placing the special value in unreachable tail slots [E3](https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-19.md)

## Impact and severity
E1 led to repeated unbacked mints and a doubled balance, paid at a 6M bounty — critical. E2 and E3 are medium: a guaranteed rare NFT can be permanently lost or skipped, breaking stated supply guarantees. Severity rises when the unbacked value is withdrawable or repeatable, and when the special outcome is a promised invariant.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aurora-inflation-spend-bugfix-review-6m-payout.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-06.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-07-traitforge%3AM-19.md