# Early depositors to DnGmxSeniorVault can manipulate exchange rates to steal funds from later depositors

First depositor mints one share then donates aUSDC to inflate share price, causing later depositors to lose funds to precision loss.

- Payout: Contest reward
- Severity: medium
- Program: Rage Trade
- Credited: tives
- Disclosed: 2022-10-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-rage-trade-judging/issues/37
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-rage-trade%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:precision-loss vuln:share-inflation

**Target:** ERC4626-style vault (DnGmxSeniorVault / DnGmxJuniorVault)
**Root cause:** convertToShares divides by totalAssets which can be inflated by direct donation after a 1-share mint, so the exchange rate is manipulable by the first depositor.
**Steps:**
1. Attacker is first depositor: `deposit(1)` mints 1 share at 1:1 ratio.
2. Attacker donates 1e8 aUSDC directly to vault, changing ratio to 1:1e8.
3. Victim deposits < 1e8 aUSDC; `convertToShares` mulDivDown rounds down to 0 shares.
4. Victim's assets accrue to attacker's single share; attacker withdraws.
**How found:** Code review of convertToShares exchange-rate math; recognized classic first-depositor donation/inflation attack on share price.
**Exploitation:** Attacker front-runs the first real deposit by minting 1 share and donating aUSDC to inflate totalAssets, then later depositors' deposits round to zero shares and their value is captured by the attacker on withdrawal.
**Insight:** Any vault computing shares as supply/totalAssets without a dead-share initialization or virtual offset is vulnerable to first-depositor donation inflation; check both senior and junior vaults.