# Suppliers can be tricked into supplying more

Attacker inflates Morpho Blue supply share price 100x on a fresh market, tricking a victim supplying by shares into depositing 100x assets, then borrows it all.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Blue
- Credited: Christoph Michel
- Disclosed: 2024-09-28
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_blue_dec2023.pdf#3.2.2
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** Morpho Blue lending market supply/withdraw share accounting
**Root cause:** withdraw computes assets via shares.toAssetsUp and can return zero assets, letting an attacker burn shares to drive totalSupplyShares to 0 while keeping totalSupplyAssets, inflating share price.
**Steps:**
1. Create/find a low-liquidity market with initial share price 1e-6.
2. Attacker `supply(assets=99)` then repeatedly `withdraw(shares)` burning shares until totalSupplyShares=0, totalSupplyAssets=99 (459 withdrawals in PoC).
3. Share price now 100x; victim's `supply(shares=1e6)` with max approval mints at inflated price, pulling 100 assets instead of 1.
4. Attacker borrows all supplied assets, locking victim out via 100% utilization.
**How found:** Noticed withdraw's assets=shares.toAssetsUp can round to zero, making withdraw a pure burn that manipulates totalSupplyShares/totalSupplyAssets ratio.
**Exploitation:** Front-run victim's share-denominated supply by inflating share price via zero-asset withdraw burns, then borrow the victim's over-supplied assets; requires victim max approval and attacker collateral to borrow.
**Insight:** When a protocol lets users specify shares instead of assets on deposit, check whether share price can be inflated by burning shares with zero-asset withdrawals on thin markets; max approvals amplify the theft.