# First 1 wei deposit can produce loss of user xETH funds in wxETH

First 1 wei wxETH deposit plus protocol xETH dripping inflates exchange rate so later stakers mint zero shares and lose their xETH.

- Payout: Audit contest
- Severity: medium
- Program: xETH
- Found by: carlitox477
- Disclosed: 2023-08-15
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-05-xeth#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-xeth%3AM-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:precision-loss vuln:share-inflation

**Target:** wxETH::stake / previewStake share-minting logic
**Root cause:** stake() mints without checking mintAmount > 0, so when xETHAmount*BASE_UNIT < exchangeRate() the user transfers xETH but receives zero wxETH shares; the exchange rate is inflated by the protocol's own drip to the first 1 wei depositor.
**Steps:**
1. Attacker frontruns all deposits with a 1 wei xETH deposit to become sole/first staker.
2. Protocol drip accrues xETH to the contract over the dripping period, inflating exchangeRate().
3. Victim calls `stake(xETHAmount)` where `xETHAmount * BASE_UNIT < exchangeRate()`.
4. previewStake rounds down to 0 shares; xETH is transferred in but 0 wxETH minted (e.g. 104166666666666600 wei yields 0 wxETH).
**How found:** Noticed stake() lacks a zero-mint check and reasoned that round-down combined with the protocol's drip mechanism (rather than direct token transfer) inflates the exchange rate, then modeled thresholds across drip rates and time windows.
**Exploitation:** Attacker stakes 1 wei first, waits while the protocol drips (e.g. 70 xETH over a week), then any subsequent staker whose deposit is below the per-share threshold transfers xETH and receives zero shares, donating value to the pool/exchange rate benefiting the first staker.
**Insight:** Inflation attacks don't require an attacker donating tokens directly—any protocol mechanism that grows the pool (drips, rewards, fees) can inflate the exchange rate for a first 1 wei depositor; check share-mint rounding against all pool-growth sources.