Submission Details
Severity:
First Depositor in PriorityPool Loses 10^3 Tokens Due to Dead Shares Allocation
Summary
The first depositor in the priorityPool loses 10^3 tokens due to the initial allocation of "dead shares."
Vulnerability Details
In the _mintShares function, the first depositor's minted tokens are reduced by DEAD_SHARES (10^3 tokens), which are assigned to address(0) when totalShares is initially zero.
function _mintShares(address _recipient, uint256 _amount) internal {
require(_recipient != address(0), "Mint to the zero address");
if (totalShares == 0) {
shares[address(0)] = DEAD_SHARES;
totalShares = DEAD_SHARES;
_amount -= DEAD_SHARES;
}
totalShares += _amount;
shares[_recipient] += _amount;
}
Impact
The first depositor is unfairly penalized, losing 10^3 tokens due to this logic.
Tools Used
Manual review.
Recommendations
Mint the dead shares during initialization to prevent the first depositor from bearing this cost.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020
USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.