# Staking module is vulnerable to first depositor attack

Super Sushi Samurai staking share formula allows first depositor to donate tokens and inflate exchange rate, diluting later depositors' shares.

- Payout: Contest reward
- Severity: medium
- Program: Super Sushi Samurai
- Credited: 0xluk3
- Disclosed: 2025-05-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_super_sushi_samurai_march2025.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Asuper_sushi_samurai_march2025%3A3.2.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** Staking module share-minting logic (SushiBar fork, operations.rell)
**Root cause:** Shares minted as amount * total_x_token / total_token_in_pool with rounding down; first depositor can donate tokens to treasury to inflate exchange rate before others deposit.
**Steps:**
1. Alice deposits 1 token, receives 1 x-token (rate 1:1).
2. Alice donates 19,999 tokens to treasury, inflating rate to 1:20000.
3. Bob deposits 25,000 tokens; gets 25000*1/20000 = 1.25 x-tokens, rounded down to 1.
4. Pool holds 45,000 tokens with 2 x-tokens total.
5. Alice redeems 1 x-token for 45000*1/2 = 22,500 tokens, profiting at Bob's expense.
**How found:** Code review of forked SushiBar share calculation in operations.rell; recognized classic ERC4626 inflation/donation attack pattern and checked whether zero-mint protection mitigated it.
**Exploitation:** Attacker acts as first depositor, seeds minimal deposit, then donates tokens directly to treasury to inflate share price; subsequent depositors' shares round down, letting attacker redeem inflated value. Requires being first depositor and either validator control or blind timing since Chromia resists reordering.
**Insight:** When auditing vault forks, check whether direct token transfers to the pool (donations) affect the share price used in minting; even with zero-share mint guards, rounding-down still lets a first depositor profit via donation inflation.