# Vault Inflation Attack

First/only depositor in Smilee vault's first epoch donates assets to inflate share price, causing later depositors' funds to round to zero shares and be stolen.

- Payout: Contest reward
- Severity: medium
- Program: Smilee Finance
- Credited: kfx
- Disclosed: 2024-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/22
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss vuln:share-inflation

**Target:** ERC4626-style vault deposit/withdraw share accounting
**Root cause:** Deposits are batched per epoch and share minting rounds down; a single early depositor can inflate assets-per-share via donation so subsequent deposits mint zero shares.
**Steps:**
1. Attacker deposits 1 wei into vault as sole first-epoch depositor
2. Roll epoch; attacker holds 1 wei of shares
3. Victims deposit 15e18 across epoch
4. Before rollEpoch, attacker transfers (donates) 15e18 baseToken directly to vault
5. Roll epoch: victims' deposits mint 0 new shares (totalSupply stays 1)
6. Attacker initiateWithdraw(1), roll epoch, completeWithdraw to drain donated + stolen funds (~30e18)
**How found:** Researcher recognized the classic ERC4626 first-depositor inflation pattern and reasoned that Smilee's epoch-batched deposit processing changes the precondition from 'be first depositor' to 'be the only depositor in the first epoch', then validated with a Foundry PoC.
**Exploitation:** Attacker must be the only depositor in the vault's first epoch (plausible for short-maturity or unpopular-token vaults). They seed 1 wei, let victims deposit, then donate assets right before epoch roll so the share price inflates and victim deposits round to zero shares; attacker redeems the single share for the entire pool.
**Insight:** When a vault batches deposits per epoch instead of minting immediately, the inflation-attack window shifts: the attacker only needs to be the sole depositor during the epoch, and the donation must land just before the epoch roll so rounding hits all queued deposits at once.