# Just-in-time deposit value capture

Spot share price or reward snapshot moved by a same-block deposit, repay, or forced trigger

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2025-09-01. Updated 2026-10-23._

## How it works
A protocol books value at a discrete event — a repayment adds interest, a range re-enters and compounds fees, a reward push is distributed — and the per-share rate or reward share jumps at that instant. If mint/redeem or deposit/withdraw price off that spot rate with no time-weighting, lockup, or exit fee, a depositor who enters just before the event and leaves just after captures value they did not earn. The broken assumption is that holders of the share are the ones who accrued the value; in fact anyone can become a holder for one block.

## Where it shows up
- Exchange-rate or share-price functions read directly from a stored total that changes on repay, interest booking, or fee compounding [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-5.md).
- Fee compounding that only runs conditionally (e.g. only when in range), leaving fees stranded until a condition flips [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-5.md).
- Reward or weight allocation computed from a single instantaneous liquidity or balance snapshot rather than a time-weighted average [E4](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.1.md)[E5](https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-02.md).
- Mint/redeem paths with no lockup, cooldown, or exit fee around the accrual event [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-5.md).
- Share price that reads an external pool's instantaneous liquidity mutable by a permissionless actor [E3](https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AM-4.md).

## How to review
The invariant: value accrued between two points in time must go only to holders present across that interval. Check whether the rate used at deposit/withdraw is time-weighted or snapshot-based. Then ask whether the accrual event is forceable in one transaction: can an outside swap flip a range back in-range [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-5.md), can a borrow/repay move an external pool's liquidity [E3](https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AM-4.md), can a flash loan inflate a balance before a reward push [E4](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.1.md)[E5](https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-02.md)? If the event is naturally occurring and not forceable, the window is narrow; if forceable, it is a one-block sandwich. For lending markets, check whether interest is booked discretely on repay and whether mint/redeem use the spot rate [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-5.md). Time-weighting the rate, or adding a lockup/exit fee, is the canonical mitigation.

## Variants seen
- Lending: repay raises exchangeRateStored, mint-before/redeem-after captures interest [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-5.md).
- AMM ranges: out-of-range fees stranded, depositor before forced re-entry captures them [E1](https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-5.md).
- Rewards: flash-loaned liquidity inflates a single snapshot to capture reward share [E4](https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.1.md).
- Rewards: balance spike before a reward push captures outsized share [E5](https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-02.md).
- External NAV (adjacent, not pure JIT capture): borrow/repay sandwich moves a pool's liquidity to inflate an exit penalty, a griefing shape [E3](https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AM-4.md).

## Impact and severity
Reported as medium-to-high findings [E1 high; E2, E3, E5 medium]; value is diverted from existing holders to a one-block participant. Severity rises when the accrual is large, the trigger is cheaply forceable, and no lockup or exit fee limits entry.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-04-burve%3AH-5.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-5.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AM-4.md
- E4: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.1.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-02-anchor%3AM-02.md