# First depositor can lock the quote target value to zero

First depositor of a DODO GSP pool with tiny amounts sets _QUOTE_TARGET_ to 0 via mulFloor rounding, permanently bricking swaps for all later LPs.

- Payout: Contest reward
- Severity: medium
- Program: Dodo Gsp
- Credited: hash
- Disclosed: 2023-12-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-dodo-gsp-judging/issues/48
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-dodo-gsp%3AM-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:share-inflation

**Target:** GSPVault/GSPFunding buyShares initial deposit logic
**Root cause:** On initial deposit, _QUOTE_TARGET_ = mulFloor(shares, _I_) with 1e18 scaling; tiny quote/base amounts make shares small enough that the product floors to 0. Subsequent deposits compute _QUOTE_TARGET_ += mulFloor(_QUOTE_TARGET_, mintRatio), which stays 0 forever.
**Steps:**
1. Attacker calls buyShares on a fresh pool after transferring ~1e5 wei of base and quote tokens.
2. shares computed as divFloor(quoteBalance,_I_) or baseBalance; _QUOTE_TARGET_ = mulFloor(shares,_I_) floors to 0.
3. Verify `gsp._QUOTE_TARGET_() == 0`.
4. Any later LP deposits large amounts; _QUOTE_TARGET_ remains 0 since 0*mintRatio=0.
5. sellBase/sellQuote revert (post-fix #122) or swap math broken, DoSing the pool.
**How found:** Code review of initial-supply branch in buyShares; noticed mulFloor 1e18 scaling and that _QUOTE_TARGET_ update multiplies by existing target, so a zero target is sticky. Wrote Foundry PoC with dust deposit then large deposit.
**Exploitation:** Attacker front-runs pool creation/first deposit with dust amounts to force _QUOTE_TARGET_=0, permanently disabling swaps for the pool; no direct fund extraction, griefing/DoS only.
**Insight:** In AMM/vault share math, check whether any state variable is updated multiplicatively by its own prior value — a zeroed initial value becomes permanently unrecoverable; dust first-deposit is the trigger.