# `LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks

Teller LenderCommitmentGroup share price manipulable via self-liquidation default, letting attacker mint 0 shares for victims and steal deposits.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0x73696d616f
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/64
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** LenderCommitmentGroup_Smart lending pool contract
**Root cause:** addPrincipalToCommitmentGroup and burnSharesToWithdrawEarnings lack slippage protection (min shares/max shares), so share price can be deflated to zero via self-liquidation default, causing new depositors to receive 0 shares.
**Steps:**
1. Attacker deposits `1e18` DAI via `addPrincipalToCommitmentGroup(1e18, attacker)` to receive shares.
2. Attacker approves forwarder and calls `acceptCommitmentWithRecipient` borrowing `1e18` with `1` wei WETH collateral.
3. Wait past loan duration, then attacker self-liquidates via `liquidateDefaultedLoanWithIncentive(bidId, -int256(1e18))`, driving `poolTotalEstimatedValue_` to 0.
4. Victim deposits `1000e18` DAI via `addPrincipalToCommitmentGroup`, receives 0 shares due to zero exchange rate.
5. Attacker calls `burnSharesToWithdrawEarnings(shares, attacker)` and receives victim's `1000e18` DAI.
**How found:** Researcher noted readme claimed no slippage risk, then reasoned that although direct donation is impossible, share price can be deflated by taking a loan and defaulting it, inspired by inflation attacks but inverted (deflation).
**Exploitation:** Attacker uses own capital to seed pool, borrows against minimal collateral, defaults and self-liquidates with max incentive to zero out pool value while retaining all shares, then new depositors mint 0 shares and attacker redeems shares for their deposits.
**Insight:** In share-based lending pools, check whether share price can be moved not only by direct donation but by protocol-native flows like loan default/liquidation incentives that alter total estimated value; missing min/max out arguments enable theft from subsequent depositors.