Merge pull request #37 from code-423n4/feature/capMint

Cap minting interval and amount

Author: HickupHH3

contracts/ArenaToken.sol

@@ -15,6 +15,12 @@ import "../interfaces/IRevokableTokenLock.sol";
 contract ArenaToken is ERC20, ERC20Burnable, Ownable, ERC20Permit, ERC20Votes {
     using BitMaps for BitMaps.BitMap;
 
+    /// mint cooldown period
+    uint256 public constant MIN_MINT_INTERVAL = 365 days;
+    /// maximum tokens allowed per mint
+    /// 10_000 = 100%
+    uint256 public constant MINT_CAP = 200; // 2%
+
     bytes32 public merkleRoot;
     /// Proportion of airdropped tokens that are immediately claimable
     /// 10_000 = 100%
@@ -27,6 +33,8 @@ contract ArenaToken is ERC20, ERC20Burnable, Ownable, ERC20Permit, ERC20Votes {
 
     /// vesting duration
     uint256 public vestDuration;
+    /// timestamp till next mint is allowed
+    uint256 public nextMint;
 
     event MerkleRootChanged(bytes32 merkleRoot);
     event Claim(address indexed claimant, uint256 amount);
@@ -52,6 +60,7 @@ contract ArenaToken is ERC20, ERC20Burnable, Ownable, ERC20Permit, ERC20Votes {
         require(_claimPeriodEnds > block.timestamp, "cannot have a backward time");
         _mint(msg.sender, _freeSupply);
         _mint(address(this), _airdropSupply);
+        nextMint = block.timestamp + MIN_MINT_INTERVAL;
         claimableProportion = _claimableProportion;
         claimPeriodEnds = _claimPeriodEnds;
         vestDuration = _vestDuration;
@@ -147,6 +156,13 @@ contract ArenaToken is ERC20, ERC20Burnable, Ownable, ERC20Permit, ERC20Votes {
      * @param amount The quantity of tokens to mint.
      */
     function mint(address dest, uint256 amount) external onlyOwner {
+        require(
+            amount <= (totalSupply() * MINT_CAP) / 10_000,
+            "ArenaToken: Mint exceeds maximum amount"
+        );
+        require(block.timestamp >= nextMint, "ArenaToken: Cannot mint yet");
+
+        nextMint = block.timestamp + MIN_MINT_INTERVAL;
         _mint(dest, amount);
     }
 

test/ArenaToken.spec.ts

@@ -87,10 +87,22 @@ describe('TokenSale', async () => {
       );
     });
 
+    it('should not allow minting until the first mint window', async () => {
+      await expect(token.connect(admin).mint(user.address, ONE_18)).to.be.revertedWith('ArenaToken: Cannot mint yet');
+    });
+
     it('should allow owner to mint new tokens', async () => {
+      await setNextBlockTimeStamp((await token.nextMint()).toNumber());
       await token.connect(admin).mint(user.address, ONE_18);
       expect(await token.balanceOf(user.address)).to.eq(ONE_18);
     });
+
+    it('should not allow minting more than the prescribed amount', async () => {
+      await setNextBlockTimeStamp((await token.nextMint()).toNumber());
+      await expect(token.mint(user.address, (await token.totalSupply()).div(50).add(1))).to.be.revertedWith(
+        'ArenaToken: Mint exceeds maximum amount'
+      );
+    });
   });
 
   describe('#sweep', async () => {