# Flash-loan share and index inflation

Share price, index or reward split derived from a live balance, supply or spot rate one caller can move

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2025-07-21. Updated 2026-10-23._

## How it works
A vault, pool or index prices a share, collateral value or reward split from a quantity one caller can move inside a single transaction: a raw token balance, an AMM spot price, a live `totalSupply()`, a lending market's `exchangeRateStored`, or a liquidity index fed by fees. A flash loan supplies temporary capital to push that quantity, the attacker mints, borrows or redeems at the distorted value, then repays. The broken assumption: the measured quantity is stable and not attacker-controlled at the moment of pricing.

## Where it shows up
- Share/asset conversion reading `balanceOf(pool)` or a sync/skim path [E4](https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-08.md)
- `totalAssets()` built from oracle paths that can silently return zero (bad fee tier, empty pool) [E2](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md)
- Liquidity index inflated by flash-loan fees when scaled supply is near dust [E1](https://bugbountylibrary.com/r/dhl%3A20250721-bojleveragemarket.md)
- Reward or yield split computed from live `totalSupply()` at distribution time [E3](https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-11.md)
- Vault valuation from AMM spot price (`get_dy_underlying`) with a zero lock period [E4](https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-08.md)
- Oracle rate sourced from a lending market's `exchangeRateStored`, movable by a large borrow in the same tx [E5](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-04.md)

## How to review
Identify every quantity that sets share price, collateral value or reward split, and name the invariant per quantity:
- Share price: the denominator (assets/supply) must not move within one tx without cost or delay; pricing must use time-weighted or snapshotted values, and balance-derived accounting must exclude unsolicited donations.
- Collateral/index value: the index must not be inflatable by fees or borrows when scaled supply is dust; check `exchangeRateStored`/`totalBorrows` cannot be moved atomically.
- Reward split: the ratio must come from a past snapshot, not live `totalSupply()` at distribution.
- Oracle paths: every path must resolve to a live, liquid pool; a misconfiguration that silently returns zero is a config/zero-path variant, not flash-loan inflation [E2](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md).
- Lock/delay parameters (`minLockPeriod`) must be non-zero and not immutable-zero [E4](https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-08.md).

## Variants seen
- Fee-driven index inflation with dust scaled supply [E1](https://bugbountylibrary.com/r/dhl%3A20250721-bojleveragemarket.md)
- Oracle misconfiguration undercounting reserves, so `totalAssets()` ignores real reserves (config/zero-path, not flash-loan capital) [E2](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md)
- Live-supply reward split skewed by flash stake [E3](https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-11.md)
- Spot-price valuation with zero lock period [E4](https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-08.md)
- Borrow-driven `exchangeRateStored` inflating an accrual oracle [E5](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-04.md)

## Impact and severity
Drains ranged from excess share minting to a 413K USDC redemption [E2](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md), collateral inflation enabling multi-asset borrowing [E1](https://bugbountylibrary.com/r/dhl%3A20250721-bojleveragemarket.md), and over-redemption of underlying [E5](https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-04.md). Severity rises when the manipulated value persists across periods [E3](https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-11.md) or when a config error silently zeroes a price path [E2](https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20250721-bojleveragemarket.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260425-singularitydynavault.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-11.md
- E4: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-08.md
- E5: https://bugbountylibrary.com/r/c4%3A2021-05-yield%3AM-04.md