Glossary
Inflation Attack
A vault exploit where the first depositor donates assets to inflate the share price, then steals a later depositor's funds through rounding when their shares round down to zero.
An inflation attack (also called the first-depositor or share-price attack) targets tokenized vaults such as ERC-4626. The attacker deposits 1 wei to mint a single share, then directly transfers a large amount of the underlying asset to the vault. This inflates the value of that one share without minting new shares, so a subsequent victim's deposit rounds down to zero shares while their assets stay in the vault — which the attacker then redeems.
Defenses include seeding the vault with an initial "dead shares" deposit, using virtual shares and assets offsets (OpenZeppelin's ERC-4626 implementation does this), and enforcing a minimum deposit. The attack is a classic example of how integer rounding and donation-based accounting can be weaponized in DeFi.