What is an ERC-4626 inflation attack?
In an ERC-4626 inflation attack, an attacker deposits a tiny amount into an empty vault to get the first shares, then sends assets directly to the vault to inflate the value of each share. The next depositor's shares round down, sometimes to zero, and the attacker redeems their shares for most of the victim's deposit.
Step by step
- A new vault has no deposits.
- The attacker deposits 1 unit of the asset and receives 1 share.
- The attacker transfers a large amount of the asset directly to the vault. No shares are minted, so the single share is now worth everything in the vault.
- A victim deposits. Their shares are calculated as their deposit divided by the inflated share price, and round down, possibly to zero.
- The attacker redeems their share for the vault’s whole balance, including most of the victim’s deposit.
The attacker can watch the mempool and front-run the victim’s first deposit.
Mitigations
- Virtual shares and assets with a decimal offset, so share prices cannot be inflated cheaply.
- Dead shares, minted to an unrecoverable address at deployment.
- An initial deposit made atomically when the vault is deployed.
- Minimum share checks so a deposit reverts if it would receive too few shares.
Not just a vault problem
Any protocol that reads a vault’s share price as a price can be manipulated through the same donation. Treat share prices as manipulable inputs. See oracle manipulation.
Frequently asked questions
Does this affect vaults that are already in use?
The risk is highest when a vault is empty or nearly empty, such as at launch or after everyone withdraws. Vaults with meaningful deposits are much harder to inflate.
What is the best mitigation?
Virtual shares and assets with a decimal offset, as implemented in OpenZeppelin's ERC-4626, make the attack unprofitable. Seeding the vault with an initial deposit at deployment also helps.
Published Updated