# Vault Share/Strategy Token Calculation Can Be Broken By First User/Attacker

First depositor inflates BPT-per-strategy-token ratio via Aura ERC4626 deposit-on-behalf, causing later depositors' shares to round to zero or be diluted.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/70
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss vuln:share-inflation

**Target:** Balancer leveraged vault strategy token minting (StrategyUtils/PoolMixin)
**Root cause:** Strategy token minting divides by totalBPTHeld without a minimum-liquidity guard, so the first depositor can inflate the BPT-per-share ratio and cause precision loss for subsequent depositors.
**Steps:**
1. Attacker is first depositor: deposit 1 BPT, receives 1 strategy token (totalBPTHeld=1, totalStrategyToken=1).
2. Attacker acquires 9999 BPT and calls `BaseRewardPool4626.deposit(9999e18, vaultAddress)` on Aura reward pool to credit the vault's balance without holding vault shares (totalBPTHeld=10000, totalStrategyToken=1).
3. Victim deposits 19999 BPT: `strategyToken = (19999 * 1) / 10000 = 1`, losing ~half value; or deposits 9999 BPT: `(9999*1)/10000 = 0`, receiving nothing.
4. Attacker redeems 1 strategy token: `bptReceived = (1 * 29999) / 2 = 14999`, profiting ~4999 BPT.
**How found:** Code review of `_convertBPTClaimToStrategyTokens` recognized the classic first-depositor share-inflation pattern; then investigated how totalBPTHeld is sourced (Aura reward pool balanceOf) and found the ERC4626 deposit-on-behalf path to inflate it without holding shares.
**Exploitation:** Attacker seeds 1 BPT, donates 9999 BPT to the vault via Aura's ERC4626 deposit-on-behalf, then exits after victim deposits to capture the inflated share value.
**Insight:** When a vault's totalAssets is read from an external reward-pool balance rather than token.balanceOf(vault), look for ERC4626 deposit-on-behalf or similar functions that let anyone credit the vault's balance and inflate the share price.