Submission Details
Severity:
ERC4626 Share Inflation in ZLP Vaults
Summary
ZLP vaults implement ERC4626 without protection against share inflation attacks through front-running initial deposits.
Vulnerability Details
// In ZLPVault.sol
function deposit(uint256 assets) public returns (uint256) {
uint256 shares = (assets * totalSupply()) / totalAssets();
// Vulnerable to first-depositor attack
_mint(msg.sender, shares);
// ...
}
Impact
Early depositors can manipulate share prices
Subsequent LP deposits receive incorrect share amounts
Tools Used
Manual review
Echidna (fuzzing)
Recommendations
// Use virtual shares from OpenZeppelin's ERC4626
import "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
contract ZLPVault is ERC4626 {
constructor(IERC20 asset)
ERC4626(asset)
ERC20("ZLP Vault", "ZLP")
{}
}
Updates
Lead Judging Commences
inallhonesty
4 months ago
inallhonesty 4 months ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
[INVALID] first deposit attack
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.