# FundRateArbitrage is vulnerable to inflation attacks

FundRateArbitrage share index derived from net value over supply is inflatable via donation, letting first depositor steal subsequent deposits through rounding.

- Payout: Contest reward
- Severity: medium
- Program: Jojo Exchange Update
- Credited: 0x52
- Disclosed: 2023-12-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-jojo-exchange-update-judging/issues/54
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-jojo-exchange-update%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** FundingRateArbitrage vault contract (getIndex/deposit)
**Root cause:** getIndex() divides net value (including donated USDC) by totalEarnUSDCBalance with no virtual offset, so a first depositor can donate to inflate the index; deposit() then computes earnUSDCAmount = amount / index, rounding small deposits to zero shares.
**Steps:**
1. Attacker deposits 1 share (or 1 wei) as first depositor.
2. Attacker donates ~100,000e6 USDC directly to the contract, inflating getIndex() to ~100,000e18.
3. Victim deposits an amount under 100,000e6; earnUSDCAmount = amount.decimalDiv(getIndex()) rounds to 0 shares.
4. Attacker withdraws, capturing the victim's deposit value.
**How found:** Code review of getIndex() and deposit() share math; recognized the classic ERC4626 first-depositor inflation pattern where net value includes donated USDC.
**Exploitation:** First-depositor inflation: deposit minimal shares, donate large USDC to inflate index, wait for victim deposits that mint zero shares, then redeem inflated shares for the victim's funds. Requires being first depositor; front-running on Arbitrum is difficult but attacker can deposit+donate atomically and revert if not first.
**Escalation:** Chained with a separate rounding bug (#57) to drain the entire contract; judged as distinct high.
**Insight:** When a vault's index = netValue/supply and netValue includes raw token balance, any direct transfer (donation) inflates share price; check whether deposit share math rounds down to zero for amounts below the inflated index.