# Shares minted before assets settle

Share price computed before transfers, ratio updates, or returned leftovers are accounted for

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-06-15. Updated 2026-10-24._

## How it works
Share or exchange-rate math assumes that the value backing a share is fully reflected at the moment shares are priced. When a deposit, claim, or report changes balances in stages — assets transferred later, collateral gains unrealized, unspent tokens returned, or value withdrawn before re-minting — the price per share is computed against an incomplete picture. Whoever acts in that window gets shares at the wrong price, and the difference is paid by everyone else.

## Where to show up
- `mint`/`deposit` that computes shares before the asset transfer or ratio update completes
- `report()` or PPS functions reading a single asset balance while unrealized collateral or pending gains exist
- Vaults with both `claim()` and `mint()` where `totalAssets` is not decremented on claim
- Callees that return unspent tokens (e.g. Uniswap V3 `increaseLiquidity`) where the caller neither forwards nor counts them
- TVL/share-price functions that count only LP tokens, ignoring idle balances

## How to review
Trace every path that changes share price and confirm the invariant: at the instant shares are priced, all assets attributable to the vault are counted and all value already withdrawn is excluded. Check ordering — does the transfer/ratio update land before or after share computation? For claim/mint pairs, verify `totalAssets` is reduced on claim so re-minting is priced correctly. For returned leftovers, confirm the caller forwards them to the depositor or includes them in TVL. For strategies holding unrealized gains, check whether a loss can be reported before the offsetting gain is realized.

## Variants seen
- Loss reported before collateral auction realizes the offsetting gain, creating a cheap-share window [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md)
- Claim releases components but mint pricing ignores the withdrawal, allowing cheap re-mint [E2](https://bugbountylibrary.com/r/dhl%3A20260615-thetanuts.md)
- Unspent tokens returned by callee are locked and excluded from TVL [E3](https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02.md)

## Impact and severity
Led to theft from other depositors via cheap-share arbitrage [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md), a 105k USDC drain [E2](https://bugbountylibrary.com/r/dhl%3A20260615-thetanuts.md), and depositor losses on withdraw from locked, uncounted funds [E3](https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02.md). Severity is high where the mispricing window is repeatable or flash-loanable; worse when TVL functions omit balances entirely, since the error persists rather than being a brief window.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-05-yearn-ybold%3AH-2.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260615-thetanuts.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02.md