★ Empty cToken-style market (zero supply/borrow)
A economic risk factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor detects whether any Compound V2-fork lending market has totalSupply at or near zero with a non-zero collateral factor enabled. An empty market -- one with no initial supply locked -- creates a critical arithmetic vulnerability in the exchange rate calculation underpinning every borrow and liquidation function.
**Why it matters** When a cToken market has zero supply, its exchange rate is computed from scratch on the first deposit. An attacker who donates a small amount of the underlying asset directly to the cToken contract before anyone supplies can inflate the exchange rate by orders of magnitude. A second depositor of even 2 wei then holds shares worth far more than deposited; using those inflated shares as collateral, the attacker drains the entire lending pool. This attack class has been executed across at least nine protocols including Hundred Finance, Sonne Finance, Onyx Protocol, and Radiant Capital. The yAudit firm explicitly flagged this risk in Sonne Finance's own audit report before the exploit; the permissionless governance execution gap was not addressed.
**Green / Yellow / Red** Green: all cToken markets have non-trivial supply locked at deploy time, or code enforces a minimum seed deposit before a market's collateral factor can be non-zero. Yellow: markets exist activated via governance with zero or minimal seed-deposit window, mitigated by other controls. Red: one or more live markets has totalSupply at or near zero with a non-zero collateral factor and no on-chain guard preventing exchange-rate inflation.
**Common gray cases** Curators may encounter markets where totalSupply is very low but non-zero (a few hundred wei from a genesis deposit). This is scored conditional yellow unless the seed deposit is economically sufficient to prevent the attack at current TVL levels; curator judgment required.
**Notable historical examples** - **Hundred Finance** (.4M, 2023): Attacker donated 500 WBTC to empty hWBTC market, inflated exchange rate, drained pool with 2 wei. - **Sonne Finance** (0M, 2024): Governance-activated empty market; attacker front-ran activation despite a yAudit warning in the protocol's own audit report. - **Onyx Protocol** (.1M, 2023): Governance-added PEPE market with no seed deposit; same vector repeated in a second incident months later. - **Radiant Capital 1st** (.5M, 2024): Aave V2 fork; native USDC market exploited in a 6-second activation window.
**★ Critical factor** This factor alone is sufficient to trigger a D or F grade under rubric v1.7.0. Any live Compound V2-fork market with totalSupply at or near zero and a non-zero collateral factor is scored as an immediate critical flag regardless of all other category outcomes.
Measurement what to look for #
Determine whether any listed Compound V2-fork market has `totalSupply == 0` and `totalBorrow == 0`, the precondition for a donation-exploit.