How is it possible to print tokens out of nowhere with the batchOverflow problem?

Question

As stated in the title I've been looking at the Batch Overflow issue that happened last year where someone printed tokens out of nowhere.

I see that when you create a token, you specify a totalSupply of the token that you are going to create so the amount of tokens must not be bigger than the TotalSupply.

When the BatchOverflow problem occured last year, someone printed tokens out of nowhere, that leads to the question which I cannot solve.

How was it possible for the guy that discovered the bug to create more tokens than the totalSupply specified ?

Isn't the totalSupply a constant value in the erc20 contract ?

Answer 1

totalSupply stores the current amount of minted tokens, not the maximum amount of tokens which can be minted.

In order to restrict this amount, one needs to apply additional code (not part of the ERC20 standard).

Otherwise, it is restricted only by the limitation of the underlying platform (i.e., the size of uint256).