# Inflated deposit price from mutable state

Deposit or share price derived from loan, pending, or balance state a user can move in the same block

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-01-13. Updated 2026-10-25._

## How it works
A deposit or share price is computed from state that is not fixed at deposit time: an active loan's accrued interest, a pending redemption total, or a token balance. The assumption that breaks is that this state is stable and reflects only the depositor's position. When another party can move that state before, during, or after the deposit, the depositor pays more (or receives fewer shares) than the position is worth, and the mover captures the difference. The same flaw appears as an accounting offset (virtual shares) that earns yield it does not own, silently diluting real holders.

## Where it shows up
- Deposit/share pricing functions that read loan interest, `totalLocked`, pending totals, or live balances [E2](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4.md)[E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md)
- Virtual-share or offset constants included in `totalSupplyShares` and in interest accrual [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.3.md)
- "First deposit" guards derived from a token balance rather than an explicit init flag [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md)
- Invariant checks that call an external, user-mutable accounting getter [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md)
- Any path where open/close of a position can happen in the same block as a victim deposit [E2](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4.md)

## How to review
Identify every input to the deposit/share price and ask who can change it and when. The invariant: the price a depositor pays must depend only on state the depositor controls or that is fixed for the block, and offset/virtual shares must not participate in yield they do not own. For guards, the flag must be set by an explicit per-user/per-reserve initialization, not inferred from balance [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md). For invariant checks, the read value must not be movable by an unprivileged caller in the same block [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md).

## Variants seen
- Virtual shares accrue interest with no owner, diluting suppliers; share-price inflation amplifies it [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.3.md)
- Active loan interest inflates `pour()` deposit price; opener resets/unwinds same block to reclaim it [E2](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4.md)
- Dust transfer flips `is_first_supply`, skipping minimum-deposit and oracle checks [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md)
- User-created redemption inflates `totalLocked()`, DoSing burn and admin calls [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md)

## Impact and severity
LP/user overpayment and yield theft [E1](https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.3.md)[E2](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4.md), bypass of first-deposit safety checks [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md), and denial of service on core functions [E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md). Severity rises when the manipulation is atomic and cheap, and when the inflated value gates a hard invariant rather than a soft quote.

## Why fixes fail
Guards keyed to balance rather than explicit state remain flippable by any transfer [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md); pricing that still reads live loan or pending state stays manipulable within a block [E2](https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4.md)[E4](https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.3.md
- E2: https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4.md
- E3: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md
- E4: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.5.md