# Donation-inflated collateral share pricing

Oracle or collateral value derived from a live token balance or exchange rate that a direct transfer can inflate

_Area: DeFi oracles, liquidations and flash loans. Seen in 12 disclosed reports; latest 2026-07-01. Updated 2026-10-23._

## How it works
A protocol prices collateral from a value that includes a raw token balance or a live exchange rate computed from that balance. A direct transfer (donation) into the pool, vault, wrapper or cToken raises that balance without minting new shares, so each existing share is suddenly worth more. The attacker's collateral is marked up for free, and they borrow against it. The broken assumption is that the balance backing shares only changes through the protocol's own mint/redeem paths.

## Where it shows up
- Oracle reads `convertToAssets()`, `totalAssets()`, `exchangeRate`, or pool reserves live [E3](https://bugbountylibrary.com/r/dhl%3A20260701-edel-xstock.md)[E7](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-1.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AM-4.md)
- Exchange rate divides by a supply that escrow/lock mechanics can shrink, hitting a floor [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-2.md)
- Rate formula subtracts a mutable accounting field (reserves, withdrawn amounts) from the numerator [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md)
- Lending function accepts an arbitrary borrower, so a victim's position can be pumped and borrowed against [E4](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md)
- Protocol assumes an external exchange rate is monotonically non-decreasing [E2](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md)
- Token transfer logic that mishandles self-transfers or flash-loan balances [E6](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)

## How to review
Identify every value used to price collateral and trace its inputs. The invariant: collateral value must derive only from internal accounting (shares minted/burned by the protocol), never from a spot token balance or a rate a third party can move by transfer. Check that donations cannot change the price within a transaction, that any external rate is manipulation-resistant or TWAP-based, and that rounding on external redeem/mint paths cannot move the rate against the protocol [E2](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md). For LP pricing, confirm reserves cannot be inflated by transfer plus `sync()` on attacker-controlled pools [E7](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-1.md).

## Variants seen
- Escrow shrinks effective supply, donation to numerator amplified by denominator floor [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-2.md)
- ERC4626 wrapper priced via live `convertToAssets()` [E3](https://bugbountylibrary.com/r/dhl%3A20260701-edel-xstock.md)
- Donation into a lending market token plus `borrowBehalf` on a victim [E4](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md)
- Admin action repricing shares instantly, sandwichable [E5](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md)
- Self-transfer/flash-loan balance inflation in token logic [E6](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)
- LP reserves inflated by donation plus `sync()` [E7](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-1.md)
- cToken exchange rate inflated by donating underlying [E8](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AM-4.md)
- External rate nudged down by rounding, tripping a disable check [E2](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md)

## Impact and severity
Drained supplier funds and reserves [E1](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-2.md)[E3](https://bugbountylibrary.com/r/dhl%3A20260701-edel-xstock.md), unauthorized debt on victims [E4](https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md), bypassed exposure limits [E7](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-1.md), and flash-loan-funded profit [E6](https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AM-4.md). Severity is high when the inflated value is borrowable in the same transaction; worse with low-liquidity assets and same-block borrow-and-exit.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-2.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260701-edel-xstock.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260315-venus-the.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md
- E6: https://bugbountylibrary.com/r/dhl%3A20241210-labubu.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-1.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AM-4.md