# First Deposit Bug

CToken first-deposit exchange-rate manipulation: attacker mints 1 wei then donates underlying, causing victim mints to round to 0 shares and attacker redeems all.

- Payout: Contest reward
- Severity: medium
- Program: Ondo Finance
- Credited: AkshaySrivastav
- Disclosed: 2023-02-28
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-01-ondo-findings/issues/247
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-ondo%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:business-logic vuln:share-inflation

**Target:** CTokenModified.sol lending cToken (mintFresh/exchangeRateStoredInternal)
**Root cause:** exchangeRateStoredInternal returns initialExchangeRateMantissa when totalSupply==0, but after a 1-wei mint the rate is derived from cash/totalSupply; a direct underlying transfer inflates cash so victim mintTokens = div_(amount, rate) rounds down to 0.
**Steps:**
1. Attacker mints smallest amount (e.g. `fDAI.mint(2e8)`) getting 1 CToken share.
2. Attacker transfers underlying directly: `DAI.transfer(address(fDAI), 1_000_000e18)` inflating getCash().
3. Victim calls `fDAI.mint(1_000_000e18)`; exchangeRate now huge so mintTokens rounds to 0; victim gets 0 shares.
4. Attacker calls `fDAI.redeem(1)` and receives entire underlying balance (3,000,000e18 in PoC).
5. Repeat or frontrun each victim deposit with steps 1-2 and backrun with redeem.
**How found:** Code review of CTokenModified mintFresh/exchangeRateStoredInternal: noticed first-deposit branch uses initialExchangeRateMantissa while subsequent rate is cash/totalSupply, and that div_ truncation plus a direct token transfer lets an attacker zero out victim shares.
**Exploitation:** Attacker seeds a fresh CToken with 1 wei mint, donates underlying to inflate exchange rate, frontruns victim deposits so their shares round to zero, then redeems the single share for the whole pool balance.
**Escalation:** Replicable per-deposit; can be repeated continuously against all depositors until market is paused, summing all user deposits as loss.
**Insight:** On Compound-style cTokens, the totalSupply==0 branch is the weak point: any direct underlying transfer after a 1-wei mint skews the cash/supply ratio. Check whether the market seeds dead shares at initialization; if not, a donation attack zeroes subsequent minters.