# It's possible to mint an infinite number of shares without increasing quote or base amounts, due to rounding down Medium · Three Sigma · NFT perpetuals · 29th January, 2024 Finding 3S-NFTPerp-M02 of the Nftperp Matching Engine security review. - Report: /reports/nftperp-ii - Source: https://cdn.sanity.io/files/qoqld077/production/87f617e82d5468500e950a669f30607376b37c32.pdf --- ### Description For very low notional amounts, when adding liquidity, [invariantIncrease](https://github.com/nftperp/NFTPerp-V2-Contracts/blob/8ea05fc0ecf299ca8374b571486846652c8725f8/src/AMM.sol#L594) is always bigger than 0 (not true for the first depositer though), but the corresponding quote and base amounts might be 0. This means that malicious users could loop addLiquidity() calls, minting a very low amount of shares each time, without ever increasing quote and base. It is most likely not profitable to perform this shares inflation, but some way could be found to exploit it in a way that is profitable. Plugging in some numbers, it was found that it is possible to mint 22 shares with 0 quote and base amount, which if looped enough times could change the pool state significantly. ### Recommendation Add a minimum notional amount when adding liquidity to reduce the attack surface. ### Status Addressed in [#653fd2c](https://github.com/nftperp/NFTPerp-V2-Contracts/commit/653fd2c18ba80ba941932dee51d0c1d99ef05f4e) --- Related findings: - [FairLauncher::participate() should allow specifying a minimum number of shares due to the overfund mechanism](https://0xsimao.com/findings/districtone-participate-specifying-shares-overfund): DistrictOne - [`GoodDollarExchangeProvider::mintFromExpansion()` will change the price due to a rounding error in the new ratio](https://0xsimao.com/findings/mento-provider-mint-price-rounding): Mento