Skip to content
Request an audit

‹ All findings

Borrowing is not vulnerable to an inflation attack, it's unnecessary to borrow when initializing the vault

Low/InfoFuji Finance·Three Sigma · Lending aggregator · 6th May, 20233S-FUJI-N01

Description

An inflation attack occurs because attackers manipulate the denominator of the assets calculation by increasing totalAssets(...), which when calculating the shares as shares = assets * supply / totalAssets(...), would make it round down and the depositing user is stolen.

In the case of debt, it's not possible to increase the denominator totalDebt(...) without borrowing, which increases the shares. In fact, if the debtShares were rounded down by attackers, it would be beneficial to the user, who would have to pay less debt for the same debtShares.

Recommendation

Remove the borrow line in the initializeVault(...).

Status

Addressed here: Fujicracy/fuji-v2#637