# Vault share price skew

Asset or supply changes outside deposit/withdraw that move the share ratio

_Area: DeFi accounting and math bugs. Seen in 5 disclosed reports; latest 2026-03-09. Updated 2026-10-23._

## How it works
Share price is assets divided by shares (or a live balance divided by supply). The broken assumption is that this ratio only moves through legitimate deposit and withdraw flows. Any path that changes assets without minting/burning shares, or burns shares without removing assets, moves the ratio instantly. Whoever deposits right after such a move, or triggers it, captures value from existing holders.

## Where it shows up
- Share mint/redeem priced from `totalAssets()`, token balance, or reserves that transfers can raise [E3](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md)[E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)
- `_burn` of shares with no matching asset removal (fee or commission burns) [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-15.md)
- Pending/unstaked amounts still counted in the conversion after shares were burned [E2](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AH-01.md)
- `totalAssets()` including balances owed to a third party (accrued fees, pending payouts) [E5](https://bugbountylibrary.com/r/c4%3A2025-01-liquid-ron%3AH-01.md)
- Any auction fill, reward route, or fee path that credits accounted balance without minting shares [E3](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md)
- Share-mint math dividing by a near-zero balance with no minimum deposit (adjacent division/overflow case) [E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)

## How to review
State the invariant: every change to assets must be matched by a proportional change to shares, and `totalAssets()` must count only user-owned assets. Then check each path that touches balances or supply:
- Can an outsider raise assets without shares (transfer, donate, auction fill)? [E3](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md)[E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)
- Does any burn leave assets behind, and can a depositor time a deposit around it? [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-15.md)
- Are burned-share amounts excluded from later conversions? [E2](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AH-01.md)
- Are operator/third-party balances subtracted before pricing? [E5](https://bugbountylibrary.com/r/c4%3A2025-01-liquid-ron%3AH-01.md)
- Is there a floor on deposit size and denominator balance? [E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)
Distinguish internal-accounting bypass (a path credits accounted balance without shares, [E3](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md)) from direct donation of tokens ([E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)); both break the same invariant.

## Variants seen
- Commission fees burned as shares, raising assetsPerShare for JIT depositors [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-15.md)
- Unstake burns shares but leaves pending tokens in the pool, inflating the ratio [E2](https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AH-01.md)
- Interest-auction `donate()` credits tokens without shares, recreating inflation [E3](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md)
- Donate/deposit/resolve/harvest sequence inflates share value and dividends [E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md)
- Accrued operator fee counted as user assets dilutes new depositors [E5](https://bugbountylibrary.com/r/c4%3A2025-01-liquid-ron%3AH-01.md)

## Impact and severity
Losses range from ~9% of a next depositor's funds [E3](https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md) to a 16.5k USD theft [E4](https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md), plus dilution of new depositors [E5](https://bugbountylibrary.com/r/c4%3A2025-01-liquid-ron%3AH-01.md). Severity rises when the skew is repeatable, cheap to trigger, or hits a default configuration [E1](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-15.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-15.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-04-cabal-liquid-staking-token%3AH-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AM-18.md
- E4: https://bugbountylibrary.com/r/dhl%3A20250620-gangsterfinance.md
- E5: https://bugbountylibrary.com/r/c4%3A2025-01-liquid-ron%3AH-01.md