Yearn yBOLD — Steal 25% of first depositor funds via share inflation

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57686-h-1-a-malicious-attacker-can-steal-25-of-the-funds-of-the-fi. Standalone Foundry PoC and full write-up: 57686-h-1-a-malicious-attacker-can-steal-25-of-the-funds-of-the-fi_exp in the evm-hack-registry mirror.

Vulnerability classes: arithmetic/rounding · first-deposit · direct-drain · frontrun-exposure

Reproduction: self-contained Foundry PoC with only forge-std — no fork. Full trace: output.txt. PoC: test/57686-h-1-a-malicious-attacker-can-steal-25-of-the-funds-of-the-fi_exp.sol.

Key info#

TL;DR#

1. Fresh strategy has totalSupply = 0 and no burned dead shares.
2. Attacker deposits 1 wei → 1 share, then donates until totalAssets = 1 + victimDeposit/2.
3. Victim deposits 1e23; convertToShares floors ≈1.999 → 1 share.
4. Attacker redeems 1 of 2 shares for half the pool → ~25% of the victim deposit stolen.

The vulnerable code#

// Yearn TokenizedStrategy._convertToSharesFromTotals (simplified)
if (supply == 0) return assets;
// @> VULN: pure round-down, no dead-share floor / min first deposit
return assets.mulDiv(supply, totalAssets_, Math.Rounding.Down);

Strategy construction does not seed an initial deposit, so the empty vault is fully inflatable.

Root cause#

Share minting is classic ERC4626 round-down against totalAssets with no minimum liquidity. Donating assets (or the finding's deposit/redeem inflation loop) raises PPS so the next depositor's share count floors hard, while their full asset amount is still transferred in.

Preconditions#

• Newly deployed strategy (via StrategyFactory) with zero supply.
• Attacker can frontrun the first real deposit in the mempool.
• Optional: management sets profitMaxUnlockTime = 0 so a 1-wei report is instant (not required if the attacker waits for unlock).

Attack walkthrough#

1. deposit(1) → 1 share.
2. Donate USER_DEPOSIT/2 and report() → PPS ≈ half the pending deposit (terminal state of the finding's inflation loop).
3. Victim deposit(1e23) → 1 share (rounded down).
4. Attacker redeem(1) → ~7.5e22 assets; net profit ≈ 2.5e22 (25% of the deposit).

Diagrams#

Impact#

Direct theft of approximately one quarter of the first depositor's funds. Subsequent depositors are safer once supply is non-trivial, but every new strategy deployment is a fresh attack surface.

Taxonomy#

• genome: arithmetic/rounding, first-deposit, direct-drain, frontrun-exposure
• severity/high · sector/vault · sector/yield-aggregator · platform/sherlock

Sources#

• AuditVault finding #57686
• Sherlock judging issue #154
• Vulnerable source: sherlock-audit/2025-05-yearn-ybold → strategy inherits Yearn TokenizedStrategy convert/deposit; factory does not seed deposit
• Yearn tokenized-strategy _convertToSharesFromTotals (assets.mulDiv(supply, totalAssets_, Down))

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 57686-h-1-a-malicious-attacker-can-steal-25-of-the-funds-of-the-fi_exp (evm-hack-registry mirror).
• AuditVault finding: 57686-h-1-a-malicious-attacker-can-steal-25-of-the-funds-of-the-fi.

Alerts & third-party analyses

• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.