First-depositor / share-inflation guard
A economic risk factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor evaluates whether the protocol's vaults or lending markets implement a first-depositor guard against share inflation attacks. Acceptable guards include: a seed deposit locked at deploy time (dead shares), a virtual-share offset (OZ 4.9 implementation), or an explicit floor check that prevents first deposits from setting an exploitable exchange rate. The check covers both ERC-4626 vaults and Compound-fork cToken markets. Source inspection is the primary data source.
Why it matters
The first-depositor share inflation attack affects any share-based accounting system where total supply can reach zero. The attack class spans cToken markets (RD-F-070), ERC-4626 vaults (RD-F-074), and hybrid architectures like Silo Finance where the receiver parameter allowed external depositors to inflate shares against capped markets. The common thread is that a zero-supply state creates a denominator-manipulation opportunity that the attacker can exploit before any legitimate user deposits. First-depositor guards (dead shares, virtual shares, or floor checks) eliminate this attack class by ensuring the denominator is never zero in practice.
Green / Yellow / Red
Green: all share-based accounting systems in the protocol have a first-depositor guard implemented in code and verifiable on-chain. Yellow: some but not all share-based systems have guards, or guards exist for ERC-4626 vaults but not for cToken-style markets. Red: no first-depositor guards in any share-based accounting system, or guards exist in documentation but are not enforced in deployed code.
Common gray cases
Protocols that deploy markets with a founding team deposit (non-code-enforced) may argue the risk is mitigated; curator must verify whether the founding deposit is locked in a way that prevents withdrawal before user deposits arrive, not merely present at the time of assessment.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether the vault has a first-depositor guard (seed deposit on deploy, virtual-share offset, or floor-check).