# Interest auctions enable inflation attacks on backstop vaults, allowing attackers to steal user deposits

Interest auction fill calls backstop donate(), letting an attacker inflate a fresh backstop vault's exchange rate and steal ~9% of the next depositor's funds via rounding.

- Payout: Contest reward
- Severity: medium
- Program: Blend
- Credited: Tricko
- Disclosed: 2025-08-13
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#m-18
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** Soroban backstop vault / interest auction mechanism
**Root cause:** Filling an interest auction calls backstop donate(), increasing internally accounted tokens without minting shares, so an attacker can indirectly donate to a fresh vault and skew the token/share exchange rate.
**Steps:**
1. Attacker deposits 4 backstop tokens into a newly created backstop: state (tokens:4, shares:4)
2. Attacker transfers `10_000 * SCALAR_7` XLM directly to the pool
3. Attacker calls `pool.gulp(XLM)` to set `reserve.data.backstop_credit`
4. Attacker calls `pool.new_auction(2, backstop, [lp], [XLM], 100)`
5. Wait one ledger (`jump_with_sequence(5)`)
6. Attacker fills auction via `pool.submit` with `RequestType::FillInterestAuction`; backstop state becomes (tokens: 960_000_0004, shares: 4)
7. Victim deposits `1200 * SCALAR_7`; receives nonzero shares (bypasses zero-mint check) but rounded down
8. Attacker queues withdrawal, waits 17 days, withdraws all shares for profit 119_999_9998
**How found:** Recognized that backstop vaults are safe against direct transfers due to internal accounting, but traced that interest-auction fills invoke donate() which credits tokens without shares — recreating the classic inflation primitive indirectly.
**Exploitation:** Attacker seeds a fresh backstop with minimal shares, fakes interest accrual by direct pool transfer + gulp, fills an interest auction to route the donation into the backstop's internal accounting, then lets a victim deposit at the inflated rate and withdraws first, capturing the rounding loss.
**Insight:** When a vault defends against donation attacks via internal accounting, look for any code path (auction fill, reward distribution, fee routing) that credits the vault's accounted balance without minting shares — that path reopens the inflation primitive.