[SECURITY] Critical Vulnerabilities in PumpLockMint.sol

[ECZ-Quantum-Labs]

Summary

Two critical vulnerabilities found in PumpLockMint.sol that were missed in the BlockSec audit (v1.1, June 2024).

Vulnerability 1: DoS via Unbounded Loop (High)

File: contracts/lock_mint/PumpLockMint.sol
Function: approverBatchBurnUnlock

The function loops through an unbounded users array and makes external calls (mintAsset.burn and lockAsset.safeTransfer) inside the loop. A large array will exceed the block gas limit, permanently bricking the function and locking user funds.

Fix: Add require(users.length <= MAX_BATCH_SIZE) or use a pull pattern.

Vulnerability 2: Centralization Risk (Critical)

File: contracts/lock_mint/PumpLockMint.sol
Function: emergencyWithdraw

Owner can withdraw ALL locked user funds at any time without timelock, multisig, or pause requirement. This is a rug pull vector.

Fix: Remove the function or add multisig + timelock + pause requirement.

Responsible Disclosure

I have NOT exploited these on mainnet. Ready to share PoC privately upon acknowledgment.

Request:

1. Acknowledgment of receipt
2. Remediation timeline
3. Bug bounty discussion