# First depositor can break minting of liquidity shares in GeVault

First depositor can inflate GeVault share price via direct token transfer, causing later depositors to receive near-zero shares and lose funds.

- Payout: Contest reward
- Severity: medium
- Program: Good Entry
- Credited: nemveer
- Disclosed: 2023-10-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-goodentry-findings/issues/367
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AM-04
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:share-inflation

**Target:** GeVault deposit/share-minting contract
**Root cause:** Share minting uses getTVL() based on balanceOf(address(this)) of aTokens, so a direct token transfer inflates vaultValueX8 and dilutes newly minted shares.
**Steps:**
1. Attacker calls `deposit(1 wei)` when totalSupply==0, receiving initial shares.
2. Attacker calls `withdraw` leaving 1 wei of shares.
3. Attacker transfers X underlying directly to the vault contract, making 1 wei share worth X.
4. Victim deposits z; gets 1 wei share worth ~3x/4 due to inflated vaultValueX8.
5. Attacker redeems 1 wei share for the inflated value, capturing victim funds; deposits below X revert on `require(liquidity > 0)`.
**How found:** Code reading of deposit share calculation: noticed liquidity minted uses getTVL() which reads balanceOf(address(this)) via getTickBalance, making it manipulable by direct transfer.
**Exploitation:** Front-run first depositor's deposit in mempool: seed 1 wei, withdraw to 1 wei share, donate X=(z/2+1) tokens directly to vault, victim's deposit mints ~1 wei share, attacker redeems inflated share to capture ~1/4 of victim funds.
**Escalation:** Larger donation X increases dilution; keeping 2 wei initial share doubles capital requirement but captures 33% of victim funds.
**Insight:** When share price derives from balanceOf(address(this)) rather than internal accounting, the classic first-depositor donation attack applies; check whether initial mint path lacks MINIMUM_LIQUIDITY burn.