# Share price inflation via donation and rounding

Assets read from live balances or protocol-favor rounding let price-per-share move without paid mint or redeem

_Area: DeFi accounting and math bugs. Seen in 65 disclosed reports; latest 2025-06-26. Updated 2026-10-23._

## How it works
A vault or lending pool prices shares as total assets divided by total supply. The broken assumption is that this ratio only moves through paid mint and redeem. Two root causes break it. First, assets are read from a live token balance, so a direct transfer (donation) raises the numerator without minting shares [E2](https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-05.md)[E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md)[E4](https://bugbountylibrary.com/r/dhl%3A20231111-mahalend.md)[E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md)[E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md)[E7](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md). Second, integer rounding in protocol favor (mint down, redeem up) lets tiny deposit/withdraw cycles across an interest-accrual boundary inflate assets-per-share while supply stays at 1 [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1.md). In both cases an actor moves the ratio without paying for shares, then mints, redeems, borrows, or self-liquidates against the distorted price [E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md)[E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md)[E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).

## Where it shows up
- Total assets from `balanceOf(address(this))` or a per-chain balance rather than stored accounting [E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md)[E4](https://bugbountylibrary.com/r/dhl%3A20231111-mahalend.md)[E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md)[E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md)
- Mint rounds shares down, redeem rounds up, with supply able to sit at 1 [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1.md)
- Any path where a direct transfer raises a share/index price without minting shares: auction fill, dividend donation, collateral index from live balance [E2](https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-05.md)[E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md)[E7](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)
- Share math that truncates to zero when supply greatly exceeds shares, so redemptions burn nothing [E2](https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-05.md)
- Division precision loss in an index after supply is driven to 1 [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1.md)[E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md)
- A vault's `convertToAssets` consumed as a lending oracle, especially after large supply burns [E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md)[E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md)
- Shares minted before debt accrual, or uncollected liquidity counted as deposit, in a lending pair [E4](https://bugbountylibrary.com/r/dhl%3A20231111-mahalend.md)

## How to review
Lead with the invariant: total assets change only through accounted deposits, withdrawals, and explicitly socialized losses, and shares burn whenever assets leave. Check that assets come from stored accounting, not live balances; that minting enforces a minimum-liquidity or virtual-share offset so supply cannot sit at 1; that every asset-reducing path also reduces supply; and that share conversion uses the same accounted totals as mint and redeem. For oracle consumers: if a lending market uses a vault's `convertToAssets`, verify the vault's total assets cannot be inflated by direct donation, especially after large supply burns [E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md)[E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md). Oracle corruption is downstream impact, not the vault bug itself.

## Variants seen
- Rounding only, no donation: protocol-favor ping-pong across an interest-accrual boundary inflating price-per-share [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1.md)
- Donation plus zero-share truncation: donation creates fake income, truncation when supply >> shares is the drain [E2](https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-05.md)
- Donation: direct transfer inflating an ERC-4626 exchange rate used as a lending oracle [E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md)
- Donation plus flash-loan fee accrual, with rounding minting cheap shares [E4](https://bugbountylibrary.com/r/dhl%3A20231111-mahalend.md)
- Donation inflating a collateral index derived from live balance, plus round-up minting free collateral [E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md)
- Donation: tiny mint plus donation to a yield-bearing collateral's controller inflating vault share price [E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md)
- Donation: donate/deposit/resolve/harvest sequence inflating dividend share value (adjacent: dividend miscalculation) [E7](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)

## Impact and severity
Losses ranged from ~$20K [E4](https://bugbountylibrary.com/r/dhl%3A20231111-mahalend.md) to ~$3.2M [E5](https://bugbountylibrary.com/r/dhl%3A20231110-raft.md) and $9.6M [E6](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md), plus an 86.72 WETH self-liquidation profit [E3](https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md), up to draining protocol TVL [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1.md). Severity rises when the distorted price feeds an oracle or liquidation engine, and when repeated events compound the ratio unboundedly.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AH-1.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AH-05.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250227-venus-zksync.md
- E4: https://bugbountylibrary.com/r/dhl%3A20231111-mahalend.md
- E5: https://bugbountylibrary.com/r/dhl%3A20231110-raft.md
- E6: https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md
- E7: https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md
- E8: https://bugbountylibrary.com/r/dhl%3A20250106-mosca.md