# Share mint priced before asset deposit

Shares computed before assets arrive or after balance/ratio state changes, diluting or inflating value

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-04-14. Updated 2026-10-23._

## How it works
Share price is a ratio: assets divided by shares. The invariant is that a depositor's shares are priced against the assets that existed *before* their own deposit lands, and that any factor applied to a balance (slashing, fees, reserves) matches the period that balance was actually exposed to. The bug appears when the code computes shares from a balance that already includes the incoming deposit, or applies a historical adjustment to funds that arrived after the event. Either way the ratio is measured at the wrong moment, so the new depositor is charged for assets they did not bring, or credited for value that was never theirs.

## Where it shows up
- `calculateShares` / `previewDeposit` called after a transfer, `deposit_for`, or external call that mutates `totalAssets()` [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AH-01.md)
- Share price formulas with `max(0, balance - reserved)` clamps where the denominator is not adjusted the same way [E2](https://bugbountylibrary.com/r/c4%3A2025-11-sukukfi%3AM-03.md)
- Checkpoint or slashing-factor logic applied to balances deposited after the last checkpoint [E1](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.1.md)
- Any ordering where state changes between reading the ratio and minting

## How to review
Trace the exact sequence: read balance, compute shares, move assets, mint. The property that must hold: shares minted equal `amount * totalSupply / totalAssets` where `totalAssets` excludes the incoming `amount`. For adjustment factors (slashing, fees), confirm the factor applies only to balance present when the event occurred. For clamped formulas, check numerator and denominator are clamped consistently. Compare two identical deposits by different users; they must yield identical shares.

## Variants seen
- Deposit into an external sink inflates `totalAssets` before share calc, so depositor mints fewer shares [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AH-01.md)
- `max(0, ...)` clamp on a negative reserve term inflates share price while supply still drops, enabling over-redemption [E2](https://bugbountylibrary.com/r/c4%3A2025-11-sukukfi%3AM-03.md)
- Prior slashing factor retroactively applied to newly deposited ETH, cutting new depositors' shares [E1](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.1.md)

## Impact and severity
Value loss to depositors through dilution [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AH-01.md), over-redemption draining the vault [E2](https://bugbountylibrary.com/r/c4%3A2025-11-sukukfi%3AM-03.md), and unfair slashing of fresh deposits [E1](https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.1.md). Severity rises when the mispricing is repeatable or arbitrageable, and when it silently corrupts the share price for all later users.

## Why fixes fail
Clamping one side of a ratio without the other leaves the inconsistency in place [E2](https://bugbountylibrary.com/r/c4%3A2025-11-sukukfi%3AM-03.md); reordering a single call without auditing every path that mutates `totalAssets` leaves sibling paths exposed [E3](https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AH-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/cantina%3Aeigenlayer_mar2025%3A3.2.1.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-11-sukukfi%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-10-hybra-finance%3AH-01.md