Company Simulator
First Flight #51
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

No Minimum Investment → Dust Share Inflation

minionteechs

Root + Impact

Description

  • Normal behavior:

    Investors should buy shares proportional to meaningful capital contributions.

  • Specific issue:

The contract lets anyone call fund_investor() with any nonzero ETH, issuing shares proportionally. This allows an attacker to send dust amounts (e.g., 1 wei) to repeatedly inflate issued_shares, diluting future investors’ value and potentially skewing share_price calculations.

// Root cause in the codebase with @> marks to highlight the relevant section
@external
@payable
def fund_investor():
...
@> assert msg.value > 0, "You must send ETH to buy shares!"
shares_to_issue: uint256 = msg.value / self.get_share_price()
​

Risk

Likelihood:

High — Any user or bot can cheaply spam micro-investments.


Impact:

Medium — Dilutes ownership and corrupts share-based logic (e.g., dividends or payouts).

Proof of Concept

Explanation:

Each 1-wei call increases issued_shares, altering share ratios without meaningful capital input.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
interface IVulnerable {
function fund_cyfrin(uint256) external payable;
}
​
contract DustSpammer {
IVulnerable target;
constructor(address _target) { target = IVulnerable(_target); }
​
function spamShares(uint256 n) external {
for (uint256 i = 0; i < n; i++) {
// Send 1 wei to inflate issued_shares
target.fund_cyfrin{value: 1}(1);
}
}
}
​

Recommended Mitigation

Mitigation Explanation


The core issue is that very small (“dust”) investments can still create shares, which allows attackers to inflate issued_shares and dilute legitimate investors.


The mitigation adds a minimum investment threshold (MIN_INVESTMENT) to the fund_investor() function. This ensures that any ETH sent below the threshold is rejected, preventing micro-investment abuse while preserving proportional share issuance for genuine investors.


By enforcing this rule:


Share issuance remains economically meaningful.


Dilution from spam or negligible contributions is eliminated.


Share-price calculations remain accurate and predictable.

- remove this code
+ add this code
@@
- assert msg.value > 0, "You must send ETH to buy shares!"
+ # Enforce a minimum investment threshold
+ MIN_INVESTMENT: constant(uint256) = as_wei_value(0.01, "ether")
+ assert msg.value >= MIN_INVESTMENT, "Investment too small!"
​
Updates

Lead Judging Commences

0xshaedyw Lead Judge
5 days ago
0xshaedyw Lead Judge 3 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.