# Virtual supply shares steal interest

Morpho Blue's virtual supply shares accrue interest despite having no owner, diluting real suppliers' yield; attacker can inflate share price to amplify the theft.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Blue
- Credited: Christoph Michel
- Disclosed: 2024-09-28
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_blue_dec2023.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** Morpho.sol lending market accounting (_accrueInterest / virtual shares)
**Root cause:** Virtual supply shares (1e6 offset) are counted in totalSupplyShares and earn interest during _accrueInterest, but correspond to no supplier, so their accrued interest is taken from real suppliers' share of assets.
**Steps:**
1. Deploy market; note virtual shares = 1e6 added to totalSupplyShares in share/asset math.
2. Supplier supplies 99 assets, then repeatedly withdraws computed shares `(totalSupplyShares+1e6).mulDivUp(1,totalSupplyAssets+1)-1` to burn shares and inflate share price ~100x.
3. Observe totalSupplyAssets remains while totalSupplyShares drops toward 0, leaving virtual shares with a large claim on assets.
4. Supply 1e6 shares worth of assets and observe pulled-in assets far exceed initial share price, demonstrating virtual-share interest capture.
**How found:** Code reading of _accrueInterest revealed virtual shares are included in totalSupplyShares and thus earn interest despite having no owner; author then wrote a Foundry test to inflate share price and quantify the effect.
**Exploitation:** Attacker inflates supply share price via repeated withdraw cycles so the unowned virtual shares hold a large proportional claim; interest accrual then routes yield to those virtual shares, diluting honest suppliers.
**Insight:** In ERC4626-style share accounting with virtual-share offsets, check whether the offset shares participate in interest/yield distribution—donation or withdraw-loop share-price inflation can turn a 'negligible' 1e-6 offset into a meaningful claim.