Burve — First deposit front-running attack

Source & credit. Reproduction of a public audit finding curated by AuditVault — the original finding: 57723-h-02-first-deposit-front-running-attack-pashov-audit-group-n. Standalone Foundry PoC and full write-up: 57723-h-02-first-deposit-front-running-attack-pashov-audit-group-n_exp in the evm-hack-registry mirror.

Vulnerability classes: frontrun-exposure · mev/frontrun · first-deposit

Reproduction: self-contained Foundry PoC, offline, forge-std only. Full trace: output.txt.

Key info#


Impact	HIGH — victim mints only 1 share; attacker captures donated + victim liquidity
Protocol	Burve single (ERC-4626-like share vault)
Vulnerable code	share mint with no dead-share floor / virtual offset
Bug class	First-depositor inflation / donation attack
Finding	Pashov Audit Group — Burve, Mar 2025 · #57723 · H-02
Report	Burve-security-review_2025-03-05
Compiler	`^0.8.24` (PoC)

TL;DR#

Alice mints 1 wei liquidity → 1 share (no dead shares).
Alice donates 1e18 of liquidity tokens, inflating totalNominalLiq.
Charlie mints 2e18 → shares = 2e18 * 1 / (1e18+1) = 1.
Alice burns her share and extracts ≥1e18 of value including Charlie's deposit.

The vulnerable code#

SOLIDITY

if (totalShares == 0) {
    shares = mintNominalLiq; // @> VULN: no dead-share floor
} else {
    shares = (mintNominalLiq * totalShares) / totalNominalLiq; // @> VULN
}

Fix: dead shares on first deposit, or virtual shares/assets (OZ ERC4626).

Diagrams#

sequenceDiagram participant Alice participant Burve participant Charlie Alice->>Burve: mint 1 wei liq → 1 share Alice->>Burve: donate 1e18 Charlie->>Burve: mint 2e18 → 1 share Alice->>Burve: burn 1 share Note over Charlie: underwater vs deposit

Impact#

Victim loses the majority of their deposit to the first-depositor attacker.

Sources#

Sources & further analysis#

Reproductions & code

Standalone PoC + full trace: 57723-h-02-first-deposit-front-running-attack-pashov-audit-group-n_exp (evm-hack-registry mirror).
AuditVault finding: 57723-h-02-first-deposit-front-running-attack-pashov-audit-group-n.

Alerts & third-party analyses

Web3Sec X hacked database: search.
Rekt leaderboard: search.
Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.

Source-level debugger — step opcodes and Solidity in sync