Mint Cap

A mint cap bounds the damage a minter can do. The contract tracks how much has been minted in the current window, for example one hour, and reverts any mint that would push the total past a fixed ceiling. It does not matter who signed the transaction: a leaked private key hits the same limit as an honest one.

A cap is usually paired with a second check that ties each mint to something real: the collateral deposited for that request, or the reserves reported by a proof of reserve feed. The per-request check stops a single mint from exceeding its backing. The window cap limits everything else that can go wrong with the key before anyone notices.

The pattern exists because uncapped minters fail badly. When a service key can complete a mint for any amount it chooses, one compromised key produces an unbacked mint of whatever size the attacker types. Keeping the cap itself behind role-based access control and a timelock stops the same key from simply raising it.