[CRITICAL] Unbounded PULSE minting — no supply cap, every claim mints without ceiling

[grantfox-oss]

Summary

pulse_token/src/lib.rs mint (lines ~88-114) has no supply ceiling. Every claim mints WIN_TOKENS (10 PULSE) or LOSE_TOKENS (2 PULSE), and every register_referral mints WELCOME_BONUS_TOKENS (1 PULSE). With no cap, total_supply grows without bound.

Additionally, leaderboard/src/lib.rs has two independent minting entry points with divergent semantics:

• reward (market-trusted): increments won_bets/lost_bets
• reward_bonus (referral-trusted): does NOT increment won_bets/lost_bets

This means total_bets (= won + lost) silently undercounts bonus-only activity and the same reward can flow through both paths with no reconciliation.

Impact

• Infinite inflation: PULSE has no hard cap; total supply is unbounded.
• Divergent accounting: reward and reward_bonus track different state, making total_bets unreliable.
• No single authority controls the mint ceiling — both the market contract and the referral registry can mint.

Fix

• Enforce a MAX_SUPPLY cap in mint, checked against total_supply.
• Unify reward/reward_bonus into a single minting path with consistent bet-count accounting.
• Document and restrict the trusted minting authority.

[grantfox-oss]

🦊 GrantFox — @Onlyklink0de has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #160)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.