Burve — Reserve share overflows due to strict reward calculation

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 56958-h-9-reserve-share-overflows-due-to-too-strict-reward-calcula. Standalone Foundry PoC and full write-up: 56958-h-9-reserve-share-overflows-due-to-too-strict-reward-calcula_exp in the evm-hack-registry mirror.

Vulnerability classes: integer-bounds · underflow · reward-calculation · fix-arithmetic

Reproduction: self-contained Foundry PoC, offline, forge-std only. Full trace: output.txt.

Key info#


Impact	HIGH — reserve share counter overflows → trim/deposit DoS
Protocol	Burve ReserveLib
Vulnerable code	`shares = (amount * reserve.shares[idx]) / balance` with no floors
Bug class	Share inflation / overflow from dust deposits
Finding	Sherlock 2025-04-burve · #56958 · H-9 · TessKimy
Report	sherlock-audit/2025-04-burve-judging
Fix	itos-finance/Burve#78
Compiler	`^0.8.24` (PoC)

TL;DR#

ReserveLib.deposit mints shares as amount * shares / balance.
Dust residuals leave balance tiny while amount > 0 still mints.
Repeated inflation drives shares near type(uint256).max.
Next deposit panics on shares += minted → permanent DoS of trim paths.

The vulnerable code#

SOLIDITY

shares = (balance == 0)
    ? amount * SHARE_RESOLUTION
    : (amount * reserve.shares[idx]) / balance; // @> VULN
reserve.shares[idx] += shares;

Fix: minimum balance/amount before minting reserve shares.

Diagrams#

flowchart TD A["trimBalance residual dust"] --> B["deposit amount against tiny balance"] B --> C["shares inflates"] C --> D{"shares near max?"} D -->|yes| E["shares += minted panics"] E --> F["trim and deposit DoS"]

Impact#

Total share overflow corrupts reserve accounting; functions that deposit to reserve revert forever.

Sources#

AuditVault finding #56958
Sherlock issue #452
Source: sherlock-audit/2025-04-burve@44cba36 Reserve.sol

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 56958-h-9-reserve-share-overflows-due-to-too-strict-reward-calcula_exp (evm-hack-registry mirror).
AuditVault finding: 56958-h-9-reserve-share-overflows-due-to-too-strict-reward-calcula.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync