# StakedCitadel depositors can be attacked by the first depositor with depressing of vault token denomination

First depositor of a new StakedCitadel vault donates Citadel directly to inflate share price, causing later depositors' funds to be rounded away and captured by attacker.

- Payout: Audit contest
- Severity: high
- Program: BadgerDAO
- Credited: hyh
- Disclosed: 2022-07-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-badger-citadel-findings/issues/217
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-badger-citadel%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss vuln:share-inflation

**Target:** StakedCitadel vault contract (deposit/_mintSharesFor share accounting)
**Root cause:** _mintSharesFor computes shares from balance()/totalSupply without a minimum deposit or dead shares, so a tiny first deposit plus a direct token transfer inflates pricePerShare to an extreme value.
**Steps:**
1. Attacker calls `deposit(1)` (1 wei) as first depositor of a fresh StakedCitadel.
2. Attacker directly transfers `10^6*1e18 - 1` Citadel to the vault, setting 1 vault token = `10^6*1e18` Citadel.
3. Victim deposits e.g. `1.9*10^6*1e18` Citadel; `_mintSharesFor` issues only 1 wei of shares due to rounding.
4. Attacker withdraws, capturing the rounded-away remainder of victim deposits.
**How found:** Code review of deposit -> _depositFor -> _mintSharesFor share math and balance() usage, recognizing the classic Yearn vault (TOB-YEARN-003) first-depositor inflation pattern.
**Exploitation:** Attacker must be first depositor of a newly deployed vault; seeds 1 wei, donates large balance to inflate share price, then passively collects rounding remainders from all subsequent deposits and exits via withdraw() with no penalty.
**Insight:** For any ERC4626-style vault, check whether the first deposit can be 1 wei and whether balance() (donation-sensitive) feeds share price; if so, first-depositor donation inflation is live.