Hidden Mint

// Dangerous: Hidden internal mint
function transfer(address to, uint256 amount) public {
    _transfer(msg.sender, to, amount);
    _mint(owner, amount / 100);  // Hidden 1% mint to owner
}

// Dangerous: Unlimited owner mint
function mint(uint256 amount) public onlyOwner {
    _mint(owner, amount);  // No cap, no timelock
}

// Dangerous: Direct supply manipulation
function updateSupply(uint256 newSupply) public onlyOwner {
    _totalSupply = newSupply;  // Bypasses mint/burn logic
}

// Common but notable: Pre-mint at deployment
constructor() {
    _mint(msg.sender, 1000000 * 10**18);  // 1M tokens to deployer
}

// Safe: Capped, transparent minting
uint256 public constant MAX_SUPPLY = 1000000 * 10**18;

function mint(address to, uint256 amount) public onlyOwner {
    require(totalSupply() + amount <= MAX_SUPPLY, "Exceeds max supply");
    _mint(to, amount);
    emit Minted(to, amount);  // Transparent event
}

{
  "issues": [
    {
      "tag": "hidden_mint",
      "severity": "high",
      "description": "Contract contains hidden internal mint function",
      "location": "transfer(address,uint256)"
    }
  ]
}