# Flash-loan share price manipulation

Share price or totalAssets derived from live balances, supply, or oracle paths a flash loan can reset or inflate

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-04-25. Updated 2026-10-23._

## How it works
Share price (assets per share) is computed from live state: a token balance, total supply, or an oracle lookup. A flash loan lets an attacker temporarily own or move enough of that state to push the price to an extreme, act at the distorted price, then unwind the loan in the same transaction. The broken assumption is that the inputs to share pricing are stable and not attacker-controllable within one transaction. When the price can be reset to a degenerate default (e.g. 1:1 at zero supply) or inflated by a donation, the attacker captures the difference.

## Where it shows up
- ERC4626 `totalAssets()`/`_convertToAssets` reading `balanceOf` or an oracle that can return zero or stale values.
- Oracle paths configured with a fee tier or pool address that has no live liquidity, silently returning zero [E1](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md).
- `maxFlashLoan` returning the contract's entire share/token balance [E2](https://bugbountylibrary.com/r/c4%3A2024-02-spectra%3AM-02.md).
- Permissionless `sync`/`skim`/flash paths that re-read raw `balanceOf` into accounting [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-12.md).
- Degenerate zero-supply / zero-asset default pricing (1:1 fallback).

## How to review
The invariant: share price must not be movable by a single transaction's borrowed funds. Check that every oracle path resolves to a live, liquid pool and reverts (not returns zero) on failure [E1](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md). Confirm `totalAssets` cannot undercount real reserves. For flash-loanable share balances, verify the vault cannot be driven to a zero-supply state that re-mints at a favorable default [E2](https://bugbountylibrary.com/r/c4%3A2024-02-spectra%3AM-02.md). For any balance-synced accounting, confirm donations cannot change share value or bypass an allowlist [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-12.md). Trace each price input to whether an attacker can control it within one tx.

## Variants seen
- Misconfigured oracle fee tier with zero-liquidity fallback makes `totalAssets` ignore reserves; flash-loaned deposit mints inflated shares [E1](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md).
- Flash loan of the entire share balance enables full redeem, resetting price to 1:1, then cheap re-mint [E2](https://bugbountylibrary.com/r/c4%3A2024-02-spectra%3AM-02.md).
- Direct donation plus flash-triggered `syncCash` inflates share value to bypass a collateral allowlist [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-12.md).

## Impact and severity
Led to direct fund loss (413K USDC drained [E1](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md)), yield theft [E2](https://bugbountylibrary.com/r/c4%3A2024-02-spectra%3AM-02.md), and bypass of admin collateral restrictions enabling unauthorized borrowing [E3](https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-12.md). Severity is high where the price input is fully attacker-controllable and the payout is real reserves; worse when failures are silent (zero instead of revert) and when flash liquidity is large.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-02-spectra%3AM-02.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-12.md