# Thetanuts vault share rounding drains pre-existing WBTC

Thetanuts BTC/USD vault had WBTC but zero totalSupply; attacker flash-loaned WBTC, minted shares via dust deposit, then initWithdraw drained pre-existing WBTC.

- Payout: Real-world hack
- Severity: high
- Program: ThetanutsVaultShareRounding
- Credited: DeFiHackLabs
- Disclosed: 2026-04-20
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/ThetanutsVaultShareRounding_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260420-thetanutsvaultsharerounding
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** ERC4626-style vault (Thetanuts BTC/USD covered call vault)
**Root cause:** Vault share price calculation when totalSupply()==0 ignores pre-existing assets, allowing first depositor to mint shares at 1:1 and later redeem against the entire vault balance.
**Steps:**
1. Flash-loan 10 WBTC from Morpho Blue.
2. Deposit 2 wei WBTC into vault (totalSupply=0) -> receive 1 share.
3. Deposit 468,000,000 wei WBTC -> receive 468,000,000 shares.
4. Call `initWithdraw(type(uint256).max)` to burn all shares and withdraw nearly all vault WBTC (including pre-existing balance).
5. Repay flash loan and transfer profit to attacker EOA.
**How found:** Attacker likely observed the vault held WBTC while totalSupply() was zero, then exploited the share price initialization flaw by being the first depositor.
**Exploitation:** Attacker used Morpho Blue flash loan to obtain 10 WBTC, seeded the zero-supply vault with a dust deposit to mint 1 share, then deposited 4.68 WBTC to get proportional shares. Calling initWithdraw with max shares burned all shares and released the vault's entire WBTC balance, including pre-existing funds, netting ~0.15 WBTC profit.
**Insight:** Check vaults with assets but zero totalSupply; first depositor can manipulate share price to steal pre-existing balances via rounding or direct redemption.