# Share Price Inflation by First LP-er, Enabling DOS Attacks on Subsequent buyShares with Up to 1001x the Attacking Cost

First LP can mint 1 wei share then donate to inflate share price, causing buyShares below 1001x donation to revert.

- Payout: Contest reward
- Severity: medium
- Program: Dodo Gsp
- Credited: 0xpep7
- Disclosed: 2023-12-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-12-dodo-gsp-judging/issues/55
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-dodo-gsp%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:share-inflation

**Target:** GSPFunding.buyShares and GSPVault._mint
**Root cause:** Initial share calculation uses min(base, quote) without locking minimum liquidity, allowing totalSupply to be reduced to 1 wei. Subsequent buyShares require mintRatio > 1000 wad due to _mint require(value > 1000), which fails for small deposits relative to inflated reserves.
**Steps:**
1. Attacker calls `buyShares` with 1001 base and equivalent quote, receiving 1001 shares.
2. Attacker calls `sellShares(1000, ...)` leaving 1 wei share.
3. Attacker transfers 1000e18 base and quote tokens to pool and calls `sync()` to inflate reserves.
4. Victim calls `buyShares` with amount less than 1001 * donationAmount; `mintRatio` < 1001 wad, computed shares < 1001, `_mint` reverts with 'MINT_AMOUNT_NOT_ENOUGH'.
**How found:** Auditor reviewed initialization logic in buyShares and noticed share calculation based on min balance without minimum liquidity lock, then tested with Foundry to confirm DoS.
**Exploitation:** Attacker spends ~1000e18 tokens to inflate reserves, then any buyShares with volume less than ~1001x that amount reverts. Attacker can retrieve funds via sellShares to repeat.
**Insight:** When a protocol mints shares proportional to deposit, check if totalSupply can be reduced to a tiny value and whether minimum mint requirements create griefing vectors. Test with small initial deposit and large donation.