# First depositor bug on unmodified Compound fork

First-depositor exchange-rate inflation on Rubicon's unmodified Compound CToken fork lets an attacker steal later depositors' funds and permanently bricks the market.

- Payout: Contest reward
- Severity: high
- Program: Rubicon
- Credited: thekmj
- Disclosed: 2025-02-17
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-04-rubicon-findings/issues/143
- Library page: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:share-inflation

**Target:** Compound-fork CToken (BathToken) lending market
**Root cause:** CToken mintFresh computes shares from exchangeRateStoredInternal with no minimum-liquidity lock at totalSupply==0, so a direct ERC20 transfer to the token contract inflates the exchange rate before the victim's mint.
**Steps:**
1. Admin deploys BathToken via createBathToken; totalSupply=0, exchangeRateStored=2e26
2. Attacker `bathTEST.mint(2e8)` receives 1 share
3. Attacker `TEST.transfer(address(bathTEST), 100e18)` directly inflates getCash and the exchange rate
4. Victim `bathTEST.mint(100e18)` mints 0 shares due to inflated rate
5. Attacker `bathTEST.redeem(1)` withdraws entire pool, profiting the victim's 100e18
**How found:** Recognized the well-known Compound/ERC4626 first-depositor donation attack in an unmodified Compound v2 fork, then read createBathToken's one-market-per-underlying require to argue in-scope bricking impact.
**Exploitation:** Attacker needs only to be first depositor: mint 1 wei-share, donate underlying directly to the CToken to inflate exchangeRate, wait for victim mint to round to zero shares, then redeem the single share for the whole balance. Because createBathToken forbids a second market for the same underlying, the sniped market cannot be recreated, bricking that asset's market.
**Escalation:** Bricking the BathHouse market for the underlying (no redeploy possible) plus theft of migrated V2 funds if a V2Migrator points at the manipulated market.
**Insight:** When auditing a forked lending/ERC4626-style contract, check whether the fork kept the original's first-deposit protections; then look for admin constraints (one market per underlying) that turn a recoverable donation attack into permanent denial of the market.