# Share price moved by donation or dust

Share or reserve math priced from live balances that a donation, dust transfer, or internal flow can shift

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-06-29. Updated 2026-10-24._

## How it works

Share and reserve math assumes live balances change only through the contract's own deposit, withdraw, and swap paths. When a share price or denominator is read from a live balance (`balanceOf`, `totalAssets`, reserves) instead of an internally tracked figure, any outside transfer changes the price. A donation or dust amount then mints or redeems shares at a distorted rate, and the difference comes out of other holders' value. The clearest case is [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md); [E1](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md) is a related valuation error where the quoted figure counts a token the payout path also hands over.

## Where it shows up

- Share mint or redeem priced from `balanceOf`/`totalAssets`/reserves rather than a tracked internal figure [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md)
- `totalAssets()` counting tokens that are not the vault's underlying asset, while redeem pays out that same token [E1](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md)
- Share formula dividing by a near-zero balance, with no minimum deposit [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md)
- A path that lets an attacker push a balance near zero (even by direct transfer) while still triggering a nonzero deposit [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md)
- Deposit and redeem paths with no min-shares/max-shares slippage bound
- "First deposit" guards keyed off a token balance instead of an explicit flag (adjacent: [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md))
- Fixed-point division that truncates to zero at small reserves, disabling invariant checks (adjacent: [E2](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md))

## How to review

Identify every value used as a share price or denominator, then ask what can change it outside the intended path. The invariant: share price must be derived only from quantities the contract itself tracks, or every path that can move the live balance must be bounded by a minimum deposit, slippage limit, or explicit guard. Check that `totalAssets()` counts only the underlying asset and that redeem pays out only what was counted [E1](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md). Check every division for truncation at small inputs and for a near-zero denominator [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md). Check that first-deposit state is a stored flag, not a balance [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md).

## Variants seen

- Donated non-asset token counted in totalAssets and paid out on redeem, double-counting the donation [E1](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md)
- Dust deposit inflates reserve shares via division by near-zero balance, compounding into overflow [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md)
- Adjacent: first LP drains pool when stable invariant rounds to zero [E2](https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md)
- Adjacent: dust transfer flips first-supply flag [E4](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md)

## Impact and severity

Losses ranged from a full reserve drain [E1](https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md) to accounting bricking via overflow [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md). Severity rises when the manipulated price is reachable in one transaction, when no slippage bound protects other users, and when the distortion compounds into overflow or permanent bricking [E3](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260629-vault4626.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-06.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-9.md
- E4: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-11.md