# StrategyLlamaLendConvex: share price manipulation via dust deposit

A dust crvUSD deposit into StrategyLlamaLendConvex minted shares that redeemed for hundreds of crvUSD due to flawed Curve Lend vault share accounting.

- Payout: Real-world hack
- Severity: medium
- Program: StrategyLlamaLendConvex
- Credited: DeFiHackLabs
- Disclosed: 2025-07-16
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/StrategyLlamaLendConvex_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250716-strategyllamalendconvex
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:medium technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** Yearn strategy contract (TokenizedStrategy) interacting with Curve Lend vault and Convex
**Root cause:** The strategy's permissionless deposit/redeem path trusted the underlying Curve Lend vault share accounting and accepted realized withdrawal loss, allowing a redeemer to receive far more crvUSD than deposited.
**Steps:**
1. Swap 124 USDC to crvUSD via Uniswap V3 exactInputSingle (fee 3000).
2. Approve and deposit crvUSD into StrategyLlamaLendConvex (0x75b7...d289) via deposit(assets, receiver), receiving strategy shares.
3. Redeem the minted shares via redeem(shares, receiver, owner), receiving inflated crvUSD amount.
4. Approve crvUSD to Curve crvUSD/USDC pool and exchange(1,0,crvUsdRedeemed,0) to USDC.
5. Observe USDC profit > 500e6 (563.12 USDC total lost).
**Exploitation:** Attacker seeded 124 USDC, swapped to crvUSD, deposited into the strategy, redeemed shares for a much larger crvUSD amount, and swapped back to USDC for profit.
**Insight:** When a strategy's deposit/redeem relies on an external vault's share price, check if a tiny deposit can be redeemed for a disproportionate amount due to rounding or realized loss acceptance; test with dust amounts and compare share minting vs redemption value.