# Vault share inflation via donation

Vault share price from live totalAssets that a donation or tiny first mint can inflate

_Area: DeFi accounting and math bugs. Seen in 5 disclosed reports; latest 2025-11-20. Updated 2026-11-02._

## How it works
A vault prices shares as `totalAssets / totalSupply`. That ratio is only fair if `totalAssets` moves *only* through deposit and withdraw. When any outside party can raise `totalAssets` without minting shares — a direct token transfer, a mint to the vault address, a public reward/penalty function, a `deposit_for` on a linked escrow — the ratio rises for free. The next depositor's shares are computed against the inflated ratio and round down, sometimes to zero, while their assets stay in the vault and accrue to the inflator. The same break happens at `totalSupply == 0`: a tiny first mint plus a donation sets an arbitrarily high price per share [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md)[E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md).

## Where it shows up
- Share math reading a live balance (`balanceOf(address(this))`, spot `totalAssets`) rather than an internally tracked figure [E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md).
- `previewDeposit`/`_convertToShares` rounding down with no `shares > 0` check after mint [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md).
- Direct ERC20 transfers or mints to the vault treated as rewards or auto-deposited [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md).
- Unauthenticated donation entry points: `receivePenaltyReward`, public `deposit_for`, donate/harvest functions [E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md).
- Forked Compound/ERC4626 code with the original's first-deposit lock removed or never present [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md).
- Collateral or oracle value derived from a manipulable exchange rate (e.g. a yield-bearing token's controller) [E4](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).

## How to review
Enumerate every path that can raise `totalAssets` without minting shares, and every path that can lower `totalSupply` without paying out. The invariant: for any deposit, `shares_minted > 0`, and the share price cannot be moved by any caller who is not depositing or withdrawing. Check that a zero-share mint reverts rather than returning silently [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md)[E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md), that the first deposit is locked or seeded (dead shares / minimum liquidity) [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md), and that `totalAssets` is tracked internally, not read from a live balance that outsiders can change [E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md). For collateral, confirm the exchange rate cannot be shifted by a 1 wei mint or a direct donation [E4](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).

## How finders spotted it
- Traced the deposit path into the rewards-pool check, saw direct transfers counted as rewards inflating `totalVirtual`, then read `_mintAfterTotalChanged` and found it returns instead of reverting on zero mint [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md).
- Read the discount path, noticed a mint straight to the vault bypassing share accounting, then traced `previewDeposit` against `totalSupply=0` with `totalAssets>0` [E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md).
- Recognized the classic first-depositor donation attack in an unmodified Compound v2 fork, then used a one-market-per-underlying constraint to argue bricking impact [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md).
- Reviewed gHYBR share math, noted the missing zero-share check, then hunted donation vectors: unauthenticated `receivePenaltyReward` and public `deposit_for` [E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md).
- E4 and E5: how found not stated in evidence.

## Variants seen
- Silent zero-share mint plus auto-credited donations [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md).
- Direct mint to vault raising `totalAssets` while `totalSupply` stays 0 [E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md).
- Unmodified Compound fork with no first-deposit lock [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md).
- Oracle/collateral exchange rate inflated by 1 wei mint plus donation [E4](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).
- Missing zero-share check with multiple public donation paths [E6](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md).
- Dividend vault where donate/deposit/resolve/harvest inflates share value [E5](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md).

## Impact and severity
Loss of all depositor principal in the worst cases [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md)[E2](https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md), permanent market bricking [E3](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md), and a $9.6M drain when the inflated rate fed a lending oracle and flash loans amplified a tiny stake [E4](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md). Impact rises with reach (every later depositor, repeated front-running on transfers [E1](https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md)) and with combination into collateral pricing [E4](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-07-allbridge-core-yield%3AM-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-07-dittoeth%3AH-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-17.md
- E4: https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md
- E5: https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AM-03.md