# Share mint price mismatch

Mint or wrap prices shares off an oracle, perp, or live rate that differs from the real execution price

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-08-11. Updated 2026-10-23._

## How it works
A vault or stablecoin mints shares/tokens using one price while it actually acquires or values assets at another. The assumption that breaks: that the price used to compute the mint amount equals the price at which value enters or leaves. When the two diverge — oracle vs. true trade price, perp quote vs. spot, or a live exchange rate tied to the token's own peg — the mint implicitly performs a mispriced trade, and the minter captures the gap [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md). In the reflexive case, the divisor is the token's own price, so a depeg makes the mint emit more tokens per unit of collateral, deepening the depeg [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md).

## Where it shows up
- Mint/share math that reads an oracle, perp quote, or `getExchangeRate()` rather than the actual execution price [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)[E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md)
- Deposit ratio (split between strategies) that can diverge from the underlying balance ratio [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)
- A divisor or multiplier tied to the minted token's own market price [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md)
- Mint amount returned from a derivative/AMM swap quote instead of a spot value [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md)
- Any path where deposit-then-withdraw is profitable without price movement

## How to review
Check the invariant: the value credited to the minter must equal the value actually contributed at execution, not an estimate. Concretely:
- Trace what price each mint/share computation uses and compare it to the price the assets are acquired or valued at [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md)
- Confirm no divisor depends on the minted token's own price/peg [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md)
- Verify deposit ratio cannot diverge from balance ratio, or that divergence is priced correctly [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)
- Test deposit-immediately-withdraw for profit under small price deviations (evidence cites up to 2%) [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)

## Variants seen
- Oracle-estimated share value vs. true trade price in a vault deposit/withdraw [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md)
- Stablecoin mint divided by its own live exchange rate, creating a depeg spiral [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md)
- Mint denominated in a perp/derivative quote (vUSD) rather than spot USD [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md)

## Impact and severity
Intrinsic arbitrage draining vault value [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md), reflexive death spiral of a stablecoin [E2](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md), and destabilization of a peg via mint-and-dump [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md). Severity rises when the gap is repeatable, when the mispriced price is the token's own peg, and when flash-loan capital makes the round-trip cheap.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-01.md
- E2: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md