# InsuranceFund depositors can be priced out & deposits can be stolen

First depositor mints 1 share then donates VUSD directly to InsuranceFund, inflating share price so later deposits mint zero shares and attacker withdraws entire pool.

- Payout: Audit contest
- Severity: high
- Program: Hubble
- Found by: cmichel
- Disclosed: 2022-06-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-02-hubble-findings/issues/42
- Library page: https://bugbountylibrary.com/r/c4%3A2022-02-hubble%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:share-inflation

**Target:** InsuranceFund.sol deposit/withdraw share accounting
**Root cause:** Share price derived from vusd.balanceOf(address(this)) rather than tracked internal accounting, so direct token transfers inflate the pool value per share; no minimum deposit or dead shares.
**Steps:**
1. Call `deposit(1)` as first depositor: mints 1 share, totalSupply=1, balance=1
2. Directly transfer `1000e6` VUSD to InsuranceFund; `balance()` becomes `1000e6+1`
3. Any deposit below `1000e6` computes `shares = _amount * 1 / (1000e6+1) = 0`
4. Attacker calls `withdraw(1)` burning the single share to receive `balance() * 1 / 1` = entire pool
**How found:** Code review of deposit/withdraw share math noticing balance() uses live token balance, enabling donation-based share price inflation (UniswapV2-style first-depositor attack).
**Exploitation:** Attacker frontruns the initial insurance fund deposit: deposits 1 wei, donates the frontrun deposit amount directly to the contract, then withdraws 1 share to drain the whole balance; repeatable to steal each subsequent deposit.
**Escalation:** Repeatable frontrun of every deposit to continuously steal funds.
**Insight:** Any vault computing shares from live token balanceOf is donation-inflatable; check first-depositor share price manipulation and whether dead shares/minimum deposit exist.