🚨 Critical Bug: Faucet Sends Infinite Tokens on Sunrise Testnet

[denissolano]

Description

The faucet on the Sunrise testnet is currently vulnerable to a bug that allows users to receive an unlimited number of tokens from a single claim. This happens without requiring any further interaction — tokens are continuously minted until the page is refreshed.

Steps to Reproduce

1. Go to the Sunrise testnet faucet.
2. Click the "Claim 30 Sunrise" button.
3. Wait (do not refresh the page).
4. Observe the wallet balance increasing repeatedly as new tokens are credited.
5. Refreshing the page stops the process.

Expected Behavior

Only 30 tokens should be distributed per claim.

Actual Behavior

Multiple batches of tokens are minted and sent to the wallet automatically and continuously until a refresh occurs.

Impact

This bug enables users to mint unlimited tokens, which can:

• Skew testing results
• Create instability in the testnet environment
• Potentially mirror vulnerabilities on mainnet if not resolved

Evidence

I recorded a video demonstrating the issue, which you can view here:
🎥 Watch the video

Environment

• Network: Sunrise Testnet
• Browser: Brave 1.78.97 (Chromium 136.0.7103.93) - 64 bits
• OS: Windows
• Wallets Used: Keplr and OneKey

Please let me know if more details are needed. I’m happy to help!

Best regards,
Denis Solano