# LoopStrategy is vulnerable to inflation attacks Medium · Three Sigma · Lending · 2nd December 2024 Finding 3S-MORE-M02 of the MORE Optimizer security review. - Protocol: https://www.more.markets/ - Report: /reports/more-optimizer - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-12-02-more-markets.pdf --- ### Description LoopStrategy inherits ERC4626Upgradeable, which calculates shares deposited as ```solidity (_decimalsOffset() is 0): shares = assets * (totalSupply() + 1) / (totalAssets() + 1); ``` As such, the following attack is possible: - User deposits 1e18 assets. - Attacker frontruns and deposits 1 asset, minting 1 * 1 / 1 = 1 share. - Attacker donates 2e18 worth of vault shares to the market. - User1 deposits 1e18 assets and receives no shares, shares = 1e18 * 2 / (2e18 + 1) = 0. - User2 deposits 1.5e18 assets and receives no shares, shares = 1.5e18 * 2 / (3e18 + 1) = 0. - Attacker redeems 1 * (4.5e18 + 1) / (1+1) = 2.25e18. ### Recommendation Consider using a bigger decimals offset or do an initial deposit. ### Status Acknowledged. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Borrowing is not vulnerable to an inflation attack, it's unnecessary to borrow when initializing the vault](https://0xsimao.com/findings/fuji-finance-inflation-attack-borrow-initializing): Fuji Finance - [`Codeup::claimCodeupERC20()` is vulnerable to sandwich attacks](https://0xsimao.com/findings/codeup-codeup-erc20-sandwich-attacks): CODEUP - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage): Teller Finance - [`Strategy::checkPoolActivity()` incorrect check leads to vulnerable price](https://0xsimao.com/findings/yieldoor-activity-incorrect-vulnerable-price): Yieldoor