# Unvalidated share mint inflation

Mint paths that trust a caller-supplied share count instead of tying shares to assets actually added

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; one confirmed bounty: $450,000; latest 2026-07-11. Updated 2026-11-02._

## How it works
A share is a claim on pooled assets, so the number minted must be tied to the value actually added. The broken assumption is that a share count reaching `mint` is already consistent with reserves. When a mint path accepts a caller-supplied share amount without checking it against `totalAssets`/`totalSupply`, shares are created that no deposit backs, and the exchange rate drifts from reality [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md).

## Where it shows up
- ERC4626 vaults exposing both a `deposit*` that returns shares and a separate `mint(shares)` that accepts a share count [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md).
- Mint/deposit functions where the share amount comes from a parameter but is never compared to reserves [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md).
- A share amount returned by one function and passed into another in the same flow [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md).

## How to review
Guidance (a reviewer aid, not directly evidenced): the invariant to hold is that for every mint, `shares_minted * exchange_price <= assets_added`, and total shares must never grow faster than total assets. Check that any share count reaching `mint` is derived and validated inside the same call, not taken from a prior return value [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md). Confirm the mint path reads current reserves and rejects share counts that exceed what the deposited assets justify.

## Variants seen
- A share amount produced by `depositETH` and passed into a separate `mint()` without validation, minting shares disproportionate to the ETH deposited [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md).

## Impact and severity
Inflation of share supply beyond backing: ~97 mpETH minted from 107 ETH, yielding ~9 ETH profit via swaps [E2](https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md). Impact scales with how much unbacked supply can be minted per call and how liquid the resulting shares are to exit.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Aztec Network** (get_residual circuit / limb decomposition) (version not stated): Aztec Multiple-Spend Error Bugfix Review. Report: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aztec-multiple-spend-error-bugfix-review.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-aztec-multiple-spend-error-bugfix-review.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250617-metapool.md
- E3: https://bugbountylibrary.com/r/c4%3A2026-02-jupiter-lend%3AM-02.md