# Malicious users can front-run to cause a denial of service (DoS) for StakedUSDe due to MinShares checks

Direct USDe donation to StakedUSDe inflates totalAssets, so the next depositor's shares fall below MIN_SHARES and deposits revert, bricking the vault.

- Payout: Audit contest
- Severity: medium
- Program: Ethena Labs
- Found by: ayden
- Disclosed: 2023-12-21
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2023-10-ethena#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-ethena%3AM-04
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StakedUSDe ERC4626 vault share conversion
**Root cause:** _convertToShares divides by totalAssets()+1 which equals the raw USDe balance, so any direct token transfer inflates the denominator without minting shares; MIN_SHARES=1 ether then makes legitimate deposits revert.
**Steps:**
1. Attacker transfers 1 ether USDe directly to StakedUSDe address (no deposit call, zero shares minted).
2. totalAssets() now returns inflated balance; share = assets*totalSupply/(totalAssets+1).
3. Victim calls `stakedUSDe.deposit(1000 ether, alice)`; computed shares < MIN_SHARES (1 ether).
4. Transaction reverts with `MinSharesViolation`, blocking deposits.
**How found:** Read _convertToShares and totalAssets() override returning _asset.balanceOf(this), noticed direct transfers inflate the denominator, then tested with a Foundry PoC showing 1000 ether deposit reverts.
**Exploitation:** Attacker needs only 1 ether USDe sent directly to the vault before any legitimate deposit; the donation raises totalAssets so all subsequent deposits compute sub-MIN_SHARES amounts and revert, denying service until redeploy or a matching donation.
**Escalation:** Larger donations can also block withdrawals per judge notes, but require large capital.
**Insight:** In ERC4626 forks, check whether totalAssets() reads raw token balance rather than an internal accounting variable; any direct-transfer donation then manipulates share price and can trip MIN_SHARES or inflation defenses.