Threat model for detecting Token Forgery vulnerabilities.

A Token Forgery Attack exploits minting policies that are too permissive. If a minting policy allows tokens to be minted under weak conditions (e.g., just requiring any signature), an attacker can mint unauthorized tokens.

Vulnerability Pattern ==

A vulnerable minting policy might only check:

MintValidation -> {
  // VULNERABLE: Anyone who signs can mint!
  list.length(self.extra_signatories) > 0
}

This is trivially satisfied by ANY signed transaction, allowing anyone to forge tokens that should be restricted.

Consequences ==

1. Validation token bypass: If a validator requires a "validation token" to prove authorization, attackers can mint their own tokens.
2. Asset theft: Forged tokens can be used to satisfy validator checks, potentially draining funds.
3. Protocol manipulation: In DeFi protocols, forged governance or utility tokens can manipulate voting, rewards, or access control.

Mitigation ==

A secure minting policy should:

• Require specific authorized signers (not just "any signature")
• Check that minting is authorized by a governance mechanism
• Verify minting is part of a valid protocol operation
• Use one-shot minting for unique tokens (NFTs, thread tokens)

tokenForgeryAttack tests if additional tokens can be minted using a minting policy the transaction under test already exercises, reusing the same redeemer. If the transaction still validates with the extra minted tokens, that minting policy is too permissive. Use tokenForgeryAttackWith to test a specific policy instead (e.g. one the transaction doesn't otherwise use).