User ETH can be permanently lost when sending a small {dust} investment, funds increase company balance while no shares are issued.

##Summary:
This finding explains how extremely small ETH deposits can be accepted without minting shares, causing silent user losses. The issue occurs due to a missing guard condition in the fund_investor() function.

##Description:
The fund_investor() function accepts extremely small {dust}ETH investments that are too small to mint even one share. These transactions still increase the company’s balance but yield zero shares for the user, effectively donating ETH to the protocol without benefit. This results in permanent user value loss and breaks the expected share-minting logic.

###Normal behavior

fund_cyfrin(1) should mint shares for every ETH invested or revert/refund if insufficient to purchase a share.

Problem behavior

Tiny (“dust”) ETH amounts are accepted but mint 0 shares, resulting in silent donations to the protocol.

Risk

Investors can lose funds with no shares received.

• Malicious UIs can exploit this to siphon dust.

• Violates protocol’s expected guarantee that every contribution yields proportional equity.

Likelihood:

Occurs whenever a user invests less than one share’s price (common in testnets, faucets, or mis-calculated inputs).

Malicious UIs can exploit this to siphon dust.

• Violates protocol’s expected guarantee that every contribution yields proportional equity.

• No guard conditions prevent it; happens deterministically with integer division.

• Permanent user value loss (ETH transferred but 0 shares).

• No guard conditions prevent it; happens deterministically with integer division.

Proof of Concept

PoC explanation:
This proof of concept demonstrates how a user can send a very small (“dust”) investment that is accepted by the contract yet mints zero shares. The test uses a simulated attacker account that contributes 1e12 wei (0.000001 ETH). After the transaction, the company balance increases while the attacker’s share count remains zero—proving ETH loss without ownership gain.

Recommended Mitigation

Mitigation explanation:
The mitigation ensures that every investor contribution either results in at least one share or reverts. By asserting that the calculated share amount (desired) is greater than zero, the function prevents acceptance of dust deposits. Adding an optional refund path ensures any leftover ETH is returned, maintaining user fairness and protocol integrity.