#  A malicious early depositor can manipulate the LP-Token price per share to take an unfair share of future user deposits 

First depositor mints 1 wei share, then RDPX collateral donation inflates share price so later depositors get fewer shares and attacker redeems profit.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: 0xWagmi
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/863
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ERC4626-style PerpetualAtlanticVaultLP vault (deposit/redeem, addRdpx)
**Root cause:** Share price derived from totalVaultCollateral/assets via mulDivDown with no minimum initial shares or dead-share protection, so a 1 wei first deposit plus collateral donation inflates price per share.
**Steps:**
1. Attacker deposits 1 wei WETH via `deposit(1 wei, hecer)` receiving 1 share.
2. RDPX collateral enters vault (via RdpxV2Core settle calling `addRdpx`); simulate with `deal(rdpx, vaultLp, 10 ether)` then `vaultLp.addRdpx(10 ether)`.
3. Victim deposits 20 ether WETH via `deposit(20 ether, investor)`, receiving few shares due to inflated `assets.mulDivDown(supply, totalVaultCollateral)`.
4. Attacker redeems 1 share via `vaultLp.redeem(1, hecer, hecer)`, extracting ~2 WETH from a 1 wei deposit.
**How found:** Recognized the classic ERC4626 first-depositor / donation inflation pattern by reading share math in PerpetualAtlanticVaultLP and noting addRdpx increases collateral without minting shares.
**Exploitation:** Attacker front-runs as first depositor with minimal capital, waits for RDPX collateral to be added to the vault (raising totalVaultCollateral), then lets victim deposit at inflated share price and redeems to capture a disproportionate share of victim funds.
**Insight:** In ERC4626-style vaults, any function that increases total assets without minting shares (here addRdpx from option settlement) is a donation vector; check whether the first depositor can be griefed or profit via share price inflation.