# EUSD.mint function wrong assumption of cases when calculated sharesAmount = 0

EUSD.mint assumes sharesAmount==0 means zero totalSupply, but integer rounding after burnShares lets a minter get 1:1 shares and inflate share value.

- Payout: Contest reward
- Severity: high
- Program: Lybra Finance
- Credited: ktg
- Disclosed: 2023-08-21
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-06-lybra-findings/issues/106
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-06
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** EUSD ERC-4626-style share token mint()
**Root cause:** mint() treats sharesAmount==0 as 'totalSupply is 0' and mints 1:1 shares, but sharesAmount can round to 0 via integer division when totalShares*amount < totalSupply, reachable because burnShares lowers totalShares while keeping totalSupply.
**Steps:**
1. Mint 1e18 eUSD to Bob -> 1e18 shares, totalSupply 1e18.
2. Bob calls `burnShares(user1, 1e18-1)` -> totalShares=1, totalSupply stays 1e18 (1 share = 1e18 eUSD).
3. Alice mints 1e18 eUSD -> gets 1 share (correct).
4. Alice mints 1e17 eUSD: `1e17 * 2 / 2e18 = 0` -> sharesAmount==0 branch mints 1e17 shares 1:1.
5. Alice now holds 1e17+1 shares worth ~1e35 eUSD, diluting others.
**How found:** Code reading of mint()'s comment '//EUSD totalSupply is 0' and noticing the assumption is wrong because getSharesByMintedEUSD uses integer division and burnShares decouples totalShares from totalSupply.
**Exploitation:** Attacker first mints a large amount then burnShares down to a tiny totalShares so share price is huge; subsequent small mint rounds sharesAmount to 0 and the fallback mints shares 1:1, granting massively over-valued shares that can be redeemed/diluted against the vault.
**Escalation:** Repeated small mints each round to zero amplify share holdings; combined with burnShares to keep totalShares low, attacker captures protocol value from other holders.
**Insight:** In share-based tokens, any `shares==0` fallback that assumes empty supply is exploitable when burnShares (or any share-burn without supply change) can make totalShares tiny while totalSupply stays large; check totalSupply==0 explicitly, not the rounded result.