# First ERC4626 deposit can break share calculation

First depositor mints 1 wei then donates assets to inflate ERC4626 share price, causing next depositor to receive 0 shares and lose funds.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: ak1
- Disclosed: 2022-11-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-astaria-judging/issues/143
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-astaria%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:share-inflation

**Target:** ERC4626 vault share accounting (ERC4626-Cloned.sol)
**Root cause:** Share minting uses assets.mulDivDown(supply, totalAssets()) with no minimum-liquidity guard, so a donated asset balance inflates totalAssets and rounds subsequent deposits to 0 shares.
**Steps:**
1. Attacker calls `deposit(1)` with 1 wei DAI, receiving 1 wei of shares (supply=1, totalAssets=1).
2. Attacker calls `transfer(vault, 1 ether)` to donate DAI directly, raising totalAssets to 1 ether+1 wei without minting shares.
3. Victim calls `deposit(100 ether)`; shares = assets.mulDivDown(supply, totalAssets()) = 100e18 * 1 / (1e18+1) rounds down to 0.
4. Victim receives 0 shares; their 100 ether DAI is absorbed into the vault, benefiting the attacker's share.
**How found:** Manual review of the ERC4626 share calculation; recognized the well-known first-depositor inflation pattern when supply==0 and mulDivDown rounding.
**Exploitation:** Attacker front-runs a victim's deposit: seeds vault with 1 wei, donates a large asset amount to inflate share price, then lets the victim's deposit round to zero shares, capturing the victim's assets via their own share value.
**Insight:** On any ERC4626 fork, check whether supply==0 mints assets 1:1 and whether direct token donations move totalAssets; a 1 wei seed plus donation can zero out the next depositor's shares.