# Borrowing is not vulnerable to an inflation attack, it's unnecessary to borrow when initializing the vault Low/Info · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-N01 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description An inflation attack occurs because attackers manipulate the denominator of the assets calculation by increasing totalAssets(...), which when calculating the shares as shares = assets * supply / totalAssets(...), would make it round down and the depositing user is stolen. In the case of debt, it's not possible to increase the denominator totalDebt(...) without borrowing, which increases the shares. In fact, if the debtShares were rounded down by attackers, it would be beneficial to the user, who would have to pay less debt for the same debtShares. ### Recommendation Remove the borrow line in the initializeVault(...). ### Status Addressed here: [Fujicracy/fuji-v2#637](https://github.com/Fujicracy/fuji-v2/pull/637) --- Related findings: - [`VaultV2::withdraw/redeem()` are vulnerable to slippage, so another function could be added to protect users](https://0xsimao.com/findings/morpho-vault-v2-withdraw-redeem-slippage-protect): Morpho Vault V2