# Share price from inflated supply

Valuation divides by a supply that includes pre-minted, fee, or dust tokens, or rounds to zero

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2025-02-17. Updated 2026-10-24._

## How it works
Share or position value is computed as `amount * scale / totalSupply`. The code assumes `totalSupply` equals the economically real, outstanding supply and that division never truncates to zero. Both assumptions break: supply can include pre-minted or fee shares, be inflated within one block, or be so large relative to a small deposit that floor division yields 0 shares. The result is a wrong price per share, or a deposit that mints nothing.

## Where it shows up
- Share conversion using floor division with no zero-result check [E1](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md)
- Denominator taken from `totalSupply()` where a `totalActualSupply()`/`getActualSupply()` exists (Balancer BPT) [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-14.md)
- Fixed-point invariant math like `(_x*_y)/1e18` that truncates to 0 at small reserves [E2](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md)
- "First deposit" guards keyed off a token balance rather than an explicit init flag [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md)
- Deposit/withdraw paths where supply is movable within a single block (flash-loanable) [E1](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md)

## How to review
Identify every division by a supply or reserve figure. For each, ask: (1) does the denominator include shares that are not economically outstanding (pre-minted, protocol fees)? Compare against the protocol's actual-supply accessor [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-14.md). (2) Can the denominator be moved within one transaction, making the ratio sandwichable? [E1](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md) (3) Can the numerator/denominator combination round to zero, and is there a minimum-shares or minimum-k guard? [E1](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md)[E2](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md) (4) Is "first deposit" state derived from a balance that any external transfer can change, or from a dedicated per-user/per-reserve flag? [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md) The invariant: shares minted must be nonzero and proportional to real outstanding supply, and first-deposit guards must be unforgeable by outside transfers.

## Variants seen
- Floor division to zero shares, then attacker captures the victim's deposit [E1](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md)
- Stable-pair invariant truncating to zero, disabling swap checks and enabling first-LP DOS [E2](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md)
- Wrong supply accessor inflating the denominator and understating TVL [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-14.md)
- First-supply guard bypassed by a dust AToken transfer flipping the derived flag [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md)

## Impact and severity
Loss of user funds via rounding/sandwich [E1](https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md), pool DOS and reserve drain [E2](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md), understated position and total TVL corrupting vault accounting [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-14.md), and skipped minimum-deposit/oracle checks on first supply [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md). Severity rises when the denominator is flash-loan-manipulable or when a zero result silently disables a safety check.

## Why fixes fail
Guards keyed off mutable balances (rather than explicit flags) and supply accessors that ignore pre-minted/fee shares leave the root assumption intact [E3](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-14.md)[E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-14.md
- E4: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md