# Underlying assets stealing in AutoPxGmx and AutoPxGlp via share price manipulation

First-depositor share inflation in AutoPxGmx/AutoPxGlp ERC4626 vaults lets an attacker donate assets to inflate share price and steal later depositors' pxGMX/pxGLP via rounding.

- Payout: Contest reward
- Severity: high
- Program: Redacted Cartel
- Credited: Jeiwan
- Disclosed: 2023-01-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-redactedcartel-findings/issues/275
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** ERC4626 vault contracts (PirexERC4626) AutoPxGmx and AutoPxGlp
**Root cause:** convertToShares uses assets.mulDivDown(supply, totalAssets()) with no minimum first deposit or dead shares, so a 1-wei first deposit plus a direct token transfer inflates share price and rounds later depositors' shares down.
**Steps:**
1. Alice deposits 1 wei pxGMX, receives 1 wei of shares (totalSupply==0 path returns assets).
2. Alice transfers 10e18-1 pxGMX directly to the vault, setting 1 share = 10e18 pxGMX.
3. Bob deposits 19e18 pxGMX; convertToShares computes 19e18*1/10e18 == 1 share.
4. Alice and Bob each redeem 1 share, both receiving 14.5e18 pxGMX; Alice profits, Bob loses ~4.5e18.
**How found:** Recognized the known Solmate ERC4626 inflation issue (transmissions11/solmate#178) and traced deposit -> previewDeposit -> convertToShares rounding with totalSupply==0 first-deposit path.
**Exploitation:** Attacker becomes first depositor with 1 wei, donates a large amount of pxGMX/pxGLP directly to the vault to inflate share price, then a victim's deposit rounds down to near-zero shares; attacker redeems to capture a portion of the victim's deposit.
**Insight:** Any ERC4626 fork of Solmate without virtual shares/dead-share seeding is exploitable: check whether the first deposit mints shares 1:1 and whether direct token transfers move totalAssets without minting shares.