# Share price manipulation without slippage bounds

Deposits/withdrawals that price shares at call time with no min/max bounds, movable by donations, claims or defaults

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-04-18. Updated 2026-10-29._

## How it works
A pool prices shares from a ratio (total assets / total shares) sampled at deposit or withdrawal time. If the caller cannot state a bound on shares received or assets paid, anyone who can move the numerator or denominator in the same transaction sets the price the victim gets. The broken assumption is that share price only moves through normal trading; in practice protocol-native flows (reward claims, loan defaults, donations) move it instantly and for free.

## Where it shows up
- Deposit/withdraw functions with no `minShares`/`maxShares`/`minAssets` parameter, or bounds that are caller-supplied but never enforced.
- Share price derived from a live balance or "total estimated value" that a permissionless function can raise in one call (reward claim, liquidation, donation).
- Permissionless functions that instantly increase TVL: `claimDelayedWithdrawals`, reward scrapes, validator-exit sweeps [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md).
- Dividend/reward credit funded by transfers in, claimable by whoever holds shares at that block [E3](https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md).
- Loan/default or liquidation paths that change pool value or share count outside deposit/withdraw [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-4.md).
- Readme or comments asserting "no slippage risk" without showing why price is bounded.

## How to review
Identify every state change that alters total assets or total shares, and ask whether an unprivileged caller can trigger it atomically around a victim's deposit or withdrawal. The invariant: for any deposit or withdrawal, the shares minted or assets returned must be bounded by values the caller specified, and no single-transaction sequence by a third party may change the price the caller receives. Check that price is not sampled mid-transaction after an attacker-controlled jump, and that reward credits are not immediately realizable by a same-block entrant.

## Variants seen
- Share price deflated to zero via self-liquidation default, so new depositors mint 0 shares [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-4.md).
- Sandwich around a permissionless reward claim that instantly raises TVL [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md).
- Flash-borrowed balance donates, buys, sells and withdraws to realize dividends in one transaction [E3](https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md).

## Impact and severity
Victims lose deposits or receive zero shares [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-4.md); queued rewards are skimmed [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md); pool funds drained for profit [E3](https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md). Severity rises when the manipulation is atomic and repeatable, and when no bound exists at all so loss is total rather than partial.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-4.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AM-3.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250619-sinstakezombie.md