# Virtual supply shares steal interest

Virtual supply shares in MetaMorpho's share conversion implicitly accrue interest, diluting real suppliers' yield as share price rises.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Metamorpho
- Credited: Christoph Michel
- Disclosed: 2024-02-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_metamorpho_dec2023.pdf#3.1.12
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_metamorpho_dec2023%3A3.1.12
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:reward-distribution

**Target:** MetaMorpho.sol share-to-asset conversion (_convertToSharesWithTotals)
**Root cause:** The shares-to-assets conversion adds virtual assets (newTotalAssets + 1) and virtual shares (10**_decimalsOffset) to totals, so unowned virtual shares earn a proportional claim on interest that belongs to real suppliers.
**Steps:**
1. Inspect `_convertToSharesWithTotals`: `assets.mulDiv(newTotalSupply + 10**_decimalsOffset, newTotalAssets + 1, rounding)`.
2. Note virtual shares (10**_decimalsOffset) are included in newTotalSupply but owned by no one.
3. As interest accrues and share price rises, virtual shares' asset claim grows proportionally.
4. Withdrawals convert using these totals, so virtual shares dilute real suppliers' interest.
**How found:** Code reading of the ERC4626-style conversion helper, noticing virtual shares are counted in supply totals and thus implicitly accrue interest despite having no owner.
**Escalation:** Impact grows as supply share price increases, giving virtual shares a larger claim on total assets.
**Insight:** In ERC4626 inflation-attack mitigations using virtual shares/assets, check whether the virtual shares are included in interest-bearing supply totals; if so they dilute real depositors as share price grows.