# Inflation of ggAVAX share price by first depositor

First depositor mints 1 wei share, donates WAVAX and calls syncRewards to inflate ggAVAX exchange rate, stealing ~500 AVAX from later depositors.

- Payout: Contest reward
- Severity: high
- Program: GoGoPool
- Credited: 0xdeadbeef0x
- Disclosed: 2023-03-21
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/209
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** ERC4626 vault (TokenggAVAX / ggAVAX)
**Root cause:** convertToShares divides by totalAssets(), which can be inflated by direct WAVAX donation plus syncRewards, so a 1-wei first deposit captures a disproportionate share of the pool.
**Steps:**
1. Deploy/initialize ggAVAX vault (front-run creation).
2. Attacker calls `depositAVAX{value:1}` to mint 1 share.
3. Attacker wraps AVAX to WAVAX and `wavax.transfer(address(ggAVAX), 1000 ether)` to inflate totalAssets.
4. Attacker calls `syncRewards()` at timestamp 1672876799 so next cycle end is 1 second away.
5. `skip(1 seconds)` then call `syncRewards()` again to fully realize inflated exchange rate.
6. Victim deposits 2000 AVAX; attacker `withdrawAVAX(maxWithdraw(bob))` for 1500 AVAX.
7. Deposits below donation amount revert with `ZeroShares()` due to rounding.
**How found:** Code review of ERC4626 convertToShares/previewDeposit showing supply==0 branch and totalAssets()-based ratio, combined with noticing syncRewards cycle-end rounding allows near-instant reward realization after a donation.
**Exploitation:** Attacker needs only 1 wei plus a donation of WAVAX to the vault, then times syncRewards near a cycle boundary so the reward cycle closes almost immediately, rebasing the share price. Subsequent depositors' shares are worth far less; attacker withdraws more than deposited, extracting victim funds.
**Insight:** On ERC4626-style vaults, check whether totalAssets() can be moved by direct token transfer and whether any sync/accrue function lets you realize the donation quickly; cycle-boundary rounding (timestamp+len)/len*len can shrink the wait to ~1 second, making classic inflation profitable.