# Share price inflation by donation

Share or index price read from live balances that a plain transfer or tiny mint can move

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-03-17. Updated 2026-11-02._

## How it works
A vault, lending market or AMM prices shares as `totalAssets / totalSupply`, or reads `balanceOf(this)` or an external token's exchange rate, from live state. The numerator can be raised without minting shares by a plain transfer in; the denominator can be driven to ~1 unit. When supply is tiny, each donated unit moves the price enormously, so a small holding becomes worth far more than it cost. The broken assumption: the numerator only grows through legitimate deposits, and the denominator is never attacker-controlled. In lending forks the same shape appears in an index: a premium divided by `totalSupply()` compounds without bound when supply is near zero [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md).

## Where it shows up
- Share price from `balanceOf(address(this))`, a `totalAssets()` that sums live balances, or an external token's exchange rate used as collateral value.
- First-deposit / first-mint branches; `MINIMUM_LIQUIDITY` handling that differs from upstream.
- Index or accumulator updated by dividing a reward/premium by `totalSupply()` (Aave-style `cumulateToLiquidityIndex`) [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md).
- Forks of Aave V3.0.x missing `virtualUnderlyingBalance`; reserves drainable to ~1 scaled unit [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md).
- `_transfer` hooks that burn or fee from a pair, including zero-value transfers [E3](https://bugbountylibrary.com/r/dhl%3A20221020-health.md).
- Modifiers that validate price after the body while the body queues rewards not yet reflected in price.

## How to review
State the invariant: share price must not change from any single actor's transfer, mint or burn that does not also change their share count proportionally. Check every path that writes the numerator or denominator and ask who can call it and at what supply. Confirm the denominator can never be driven to ~0 or ~1 unit while value remains, and that donations cannot raise per-share value for the donor. For forks, diff against upstream: locked vs burned minimum liquidity, presence of virtual balances, and whether premium/reward division is bounded when supply is small [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md).

## How finders spotted it
- Recognized an Aave V3.0.x fork lacking `virtualUnderlyingBalance` and that `cumulateToLiquidityIndex` divides premium by `totalSupply`, making a near-empty reserve's index hypersensitive [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md).
- Noticed `_transfer` burns from the pair on every transfer, including zero-amount ones, so reserves can be moved without net capital (evidence says "likely identified") [E3](https://bugbountylibrary.com/r/dhl%3A20221020-health.md).
- For E2 the spotting method is not stated; the mechanism is inferred from the report [E2](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).

## Variants seen
- Index inflation via flashloan premium divided by near-zero supply [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md).
- Collateral valued from a manipulable external exchange rate, inflated by donation plus a 1 wei mint [E2](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).
- Token transfer hook burning pair reserves to inflate AMM price [E3](https://bugbountylibrary.com/r/dhl%3A20221020-health.md).

## Impact and severity
Direct fund loss: ~257K dUSD borrowed against inflated collateral [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md); $9.6M drained after a 10M reUSD borrow [E2](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md); ~16.64 BNB [E3](https://bugbountylibrary.com/r/dhl%3A20221020-health.md). Impact scales with how much the inflated price feeds borrowing or swaps, and flash loans let small capital compound the effect [E1](https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md)[E2](https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260317-dtrinitydlend.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250626-resupplyfi.md
- E3: https://bugbountylibrary.com/r/dhl%3A20221020-health.md