# Inflation attack in VotiumStrategy

VotiumStrategy vault lacked min-output check, letting an attacker front-run the first deposit, inflate share price via donation, and steal the victim's deposit.

- Payout: Contest reward
- Severity: medium
- Program: Asymmetry Finance
- Credited: adriro
- Disclosed: 2024-02-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/35
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:share-inflation

**Target:** VotiumStrategy vault deposit() share-minting logic
**Root cause:** deposit() computes mintAmount from cvxPerVotium() using balanceOf-derived totals without a minimum-output check, so a donation inflates priceBefore and rounds the victim's minted shares to zero.
**Steps:**
1. Attacker calls `deposit()` with ETH buying `1e18` CVX -> assets=1e18, supply=1e18
2. Attacker calls `requestWithdraw(1e18 - 1)` -> supply=1, cvxUnlockObligations=1e18-1
3. Attacker transfers (donates) X CVX directly to VotiumStrategy
4. priceBefore = (X + 1e18 - (1e18-1)) * 1e18 / 1 = (X+1)*1e18
5. Victim's `deposit()` buys X CVX; mintAmount = X*1e18 / ((X+1)*1e18) = 0
6. Victim minted zero shares; attacker calls `requestWithdraw()` to withdraw all CVX including victim's deposit
**How found:** Code reading of deposit() in VotiumStrategy vs AfEth: noticed AfEth enforces `_minout` (revert BelowMinOut) but VotiumStrategy mints without any minimum-output validation, making it susceptible to the known inflation attack.
**Exploitation:** Attacker front-runs the victim's deposit: seeds the vault, withdraws all but 1 wei of shares, donates CVX to inflate share price, victim's deposit mints 0 shares, attacker withdraws the combined balance.
**Insight:** When auditing vault/strategy contracts, compare share-minting paths across sibling contracts: a min-output check present in the aggregator but absent in the underlying strategy leaves the strategy directly exploitable via donation-based share inflation.