# Assets deposited before calculating shares amount to mint will cause users to mint less shares

GovernanceHYBR.deposit deposits HYBR into votingEscrow before computing shares, inflating totalAssets so depositors mint fewer shares than owed.

- Payout: Contest reward
- Severity: high
- Program: Hybra Finance
- Credited: asui
- Disclosed: 2025-11-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-10-hybra-finance#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** GovernanceHYBR.sol deposit function (ERC4626-style share minting)
**Root cause:** deposit() transfers HYBR into votingEscrow (increasing totalAssets()) before calling calculateShares(amount), so the new deposit is counted as existing assets in the share ratio.
**Steps:**
1. Bob deposits 100e18 HYBR via gHybr.deposit(100e18, bob) at 1:1 ratio, receiving 100 shares.
2. Alice approves and calls gHybr.deposit(100e18, alice).
3. Inside deposit, HYBR is deposited into votingEscrow first, raising totalAssets to 200.
4. calculateShares(100e18) then computes 100*100/(100+100)=50 shares.
5. Alice receives only 50 shares for 100 HYBR, losing value to the pool.
**How found:** Code reading of deposit() ordering: noticed shares are computed after the external deposit_for call mutates totalAssets, then confirmed with a forge PoC comparing Bob and Alice deposits.
**Exploitation:** Any depositor after the first suffers dilution: their own deposit inflates totalAssets before share computation, so they mint shares at a worse ratio and lose assets to existing holders.
**Insight:** In ERC4626-style vaults, check whether share calculation happens before or after any state-changing transfer/deposit; an external call that bumps totalAssets before calculateShares silently dilutes the depositor.