# Broken slippage check in erc4626.erc4626mint

Metamorpho's ERC4626 mint bundler clamps shares to vault maxMint before checking maxAssets, letting users pay a far worse share price than their slippage limit.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Metamorpho
- Credited: Christoph Michel
- Disclosed: 2024-02-23
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_metamorpho_dec2023.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_metamorpho_dec2023%3A3.1.2
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** ERC4626Bundler.sol erc4626Mint function
**Root cause:** The maxAssets slippage check is applied to Math.min(shares, vault.maxMint(receiver)) rather than the user's requested shares, so the effective share price enforced differs from the intended one.
**Steps:**
1. User calls erc4626Mint with shares=1000, maxAssets=1000 (expecting price 1.0).
2. Vault maxMint(receiver) returns 1, so shares is clamped to 1.
3. Share price spikes to 1000.0; mint of 1 share costs 1000 assets.
4. maxAssets check passes since 1000 <= 1000, user overpays for a single share.
**How found:** Code review of the bundler: noticed the slippage parameter was compared against a min-clamped shares value rather than the user-supplied shares, then constructed a numeric example where maxMint=1 and price jumps to 1000.
**Exploitation:** A user submitting a mint transaction with a maxAssets slippage bound can be filled at a much worse per-share price when maxMint is small and price moves, because the check is evaluated against the clamped share count instead of the requested amount.
**Insight:** When a slippage/limit check is applied to a value that was already clamped by an external call (maxMint/maxDeposit), verify the limit is enforced against the user's original intent, not the clamped quantity — otherwise the effective price bound silently changes.