Share price manipulation attack

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-05-bakerfi/blob/main/contracts/core/Vault.sol#L225

Vulnerability details

Proof of Concept

In this variant of share price manipulation attack, an attacker will need to deploy a small amount of assets, like 1 wei, just to mint 1 wei of shares and then donate aave collateral tokens directly to the contract, to increase share price to make its price to be e18 for example.

Then all next depositors may lose some value to the attacker and this value depends on the amount they deposited. There is no 0 shares check, which means that depositor can receive nothing at all after deposit.

Impact

User lose deposited assets.

Tools Used

VsCode

Recommended Mitigation Steps

Make sure first depositor mints big amount of shares.

Assessed type

Error

[c4-judge]

0xleastwood marked the issue as duplicate of #39

[c4-judge]

0xleastwood marked the issue as satisfactory