# The Rounding Done in Protocol's Favor Can Be Weaponized to Drain the Protocol

Share-price inflation via interest-accrual rounding lets attacker inflate 1 share to 8000 ETH, then a throwaway account borrows all assets and abandons debt, draining protocol TVL.

- Payout: Contest reward
- Severity: high
- Program: Interest Rate Model
- Credited: 0x73696d616f
- Disclosed: 2024-04-06
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-04-interest-rate-model-judging/issues/41
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:precision-loss vuln:share-inflation

**Target:** ERC4626-style Market lending pool (Market.sol)
**Root cause:** Deposit rounds shares down and withdraw rounds shares up in protocol's favor; combined with interest accrual, an attacker can repeatedly deposit/withdraw to inflate assets-per-share while totalSupply stays 1. A separate rounding-up on withdraw lets a 1-wei collateral position be burned to zero shares while debt remains.
**Steps:**
1. Deposit 0.01 ether, borrow 0.005 ether, advance 1 block + 10s to accrue 1 wei interest, deposit 2 wei, refund debt, redeem all but 1 wei so totalAssets=2, totalSupply=1
2. Loop: `market.deposit(totalAssets*2 - 1)` returns 1 share (rounded down); `market.withdraw(1)` burns 1 share (rounded up); repeat until totalAssets reaches desiredPricePerShare (8000 ether)
3. Withdraw `totalAssets - desiredPricePerShare` to leave totalAssets=8000 ether, totalSupply=1
4. `market.mint(1, throwAwayAccount)` giving throwaway 1 share worth 8000 ether
5. Throwaway: enterMarket, borrow 3000 ether of WETH against the 1 share, then `withdraw(1)` — allowed since shortfall check passes, but burns the whole 1 share via rounding up, leaving 0 collateral and 3000+ ether debt
6. Original account (sole remaining shareholder, never borrowed) withdraws all totalAssets and keeps the borrowed WETH
**How found:** Code reading of Market.sol#L726 rounding directions; noticed deposit mints floor(shares) and withdraw burns ceil(shares), and that interest accrual lets an attacker repeatedly exploit the asymmetry while totalSupply stays 1. Then observed that `withdraw(1)` on a 1-wei collateral position passes the shortfall check but burns the entire share, enabling debt abandonment.
**Exploitation:** Attacker needs a market with totalSupply 0 (or near-zero) and available borrow liquidity. Using only dust capital plus interest accrual, they inflate share price to 8000 ether, mint 1 share to a throwaway contract, borrow all borrowable assets against it, then abandon the position by withdrawing 1 wei which rounds the collateral share to zero. The throwaway is left with debt and no collateral; the original account, as sole shareholder, redeems the entire TVL plus the borrowed funds.
**Escalation:** Chains two rounding bugs: share-price inflation (deposit rounds down / withdraw rounds up) plus the withdraw rounding-up that zeroes a 1-wei collateral position, converting a classic first-depositor inflation into a full-TVL drain.
**Insight:** When a vault rounds both deposit (down) and withdraw (up) in protocol favor, an attacker can ping-pong tiny amounts across an interest-accrual boundary to inflate price-per-share without donations. Also check whether the shortfall/health check runs before or after the share burn — if before, a 1-wei withdraw can zero collateral while debt persists.