Cowrie Research

empty-market-exchange-rate-inflation

19 min read

Empty-Market Exchange-Rate Inflation / Precision-Loss Redemption

  • Name: Empty-market exchange-rate inflation / precision-loss redemption
  • Category: exploit pattern / lending-market accounting failure / empty-pool inflation / rounding-loss exploit
  • Summary: This exploit family hits lending markets when an attacker can first reduce a market to an almost-empty state, then inflate the accounting value of the remaining receipt tokens, and finally redeem or borrow against that distorted value while precision loss rounds the required receipt-token burn down. In Compound-style forks the printable variable is usually the exchange rate after a direct donation; in Aave-v2-style forks it can be the liquidityIndex after fee accrual in an empty reserve; in accumulator-based systems it can be a global collateral scaler such as lending_accumulator. The recurring review mistake is to collapse three different conditions into one vague market is small story: the market has become economically empty, one actor now owns the denominator that decides what the next donation / fee event means, and that printed value is already allowed to matter as redeemable or borrowable system truth. The market is not broken by donation or fee generation alone; it breaks because empty-market state, value-accounting trust, and truncating arithmetic combine into a cash-out path.
  • What it is:
    • A Compound-style market tracks an exchange rate roughly as (cash + borrows - reserves) / totalSupply, while an Aave-v2-style market credits suppliers through a rebasing index such as liquidityIndex.
    • Other lending systems store supplier value as a global accumulator times a tiny raw share balance; if the accumulator can be pumped in an empty market, the same exploit family reappears with different variable names.
    • When totalSupply or effective supplier count is tiny, each remaining receipt-token wei represents an absurd amount of underlying on paper.
    • In Compound-style forks, direct underlying transfers into the market contract can raise cash even though no new receipt tokens are minted.
    • In Aave-v2-style forks, flash-loan fees or other reserve revenue can be concentrated into the attacker’s microscopic position if the reserve is still empty.
    • If redemption or burn math later truncates in the attacker’s favor, the protocol may burn fewer receipt tokens than economic reality requires.
    • That inflated accounting value then becomes borrow power, redemption value, or liquidation value against deeper-liquidity markets.
  • Typical preconditions:
    • The target market can be driven to zero or near-zero totalSupply, or a freshly launched reserve can still have only one meaningful supplier.
    • Some solvency-critical accounting variable can be inflated without minting proportional new receipt tokens: raw-balance-sensitive exchange-rate math, or fee-driven index growth concentrated into an empty reserve.
    • Another protocol module accepts the inflated receipt token as valid collateral or liquidation collateral.
    • One redeem / seize / liquidation / burn path rounds down in a way that is harmless at normal scale but catastrophic when only a few receipt-token wei remain.
    • The attacker can source enough underlying or flash-loan volume to make the inflation step large relative to the empty market.
  • Common vulnerable surfaces:
    • Compound v2 forks or similar cToken / hToken markets with empty or nearly empty listings
    • Aave-v2-style forks whose fresh reserves can go live before any protective seed deposit or temporary collateral quarantine
    • markets whose receipt-token exchange rate reads raw underlying balance after direct transfers, or whose rebasing index can be inflated by attacker-controlled reserve revenue
    • redeemUnderlying, burn, or related paths that truncate receipt-token burn amounts
    • liquidation flows that let the attacker recycle the last residual receipt tokens across sibling markets
    • newly deployed or duplicate markets that never received a non-burnable seed supply
  • Exploit sequence:
    1. The attacker finds an unused or attacker-dominated market, or waits for a freshly launched reserve that still has no meaningful outside deposits.
    2. The attacker mints a tiny fresh position so they own nearly all remaining receipt supply.
    3. The attacker inflates the accounting value of that position without minting proportional new shares: direct underlying donation in Compound-style forks, or concentrated fee accrual into liquidityIndex in Aave-style forks.
    4. The attacker uses the now-overpriced receipt token as collateral to borrow stronger assets from sibling markets, or prepares to redeem the inflated underlying value back out.
    5. A truncation / precision-loss edge lets the attacker redeem most of the inflated value while burning fewer receipt-token wei than should be required.
    6. The attacker liquidates or resets the residual position and repeats the same pattern against other markets.
  • Variants:
    • Pure empty-market inflation — the attacker mainly monetizes the distorted accounting value through over-borrowing.
    • Precision-loss redemption — the decisive profit comes from redeemUnderlying, burn, or similar math rounding down the shares burned.
    • Compound-style donation inflation — direct underlying transfers push exchange rate up in an almost-empty market.
    • Aave-style fee / liquidityIndex inflation — flash-loan fees or similar reserve revenue are concentrated into the first depositor of a fresh reserve.
    • Accumulator inflation — donated reserve balance or similar accounting revenue directly pumps a global collateral scaler in an otherwise empty market.
    • Cross-market drain — one manipulated empty market becomes collateral used to drain unrelated deeper-liquidity markets.
    • Duplicate-market mistake — teams accidentally deploy or leave live a second unused market for the same asset, creating the perfect empty-state target.

Three empty-state promotions reviewers should not collapse

  1. The market has become economically empty

    • Supply may still be nonzero, but breadth has collapsed far enough that ordinary assumptions about socialized value no longer hold.
    • The important question is not just is totalSupply > 0? but has the market effectively fallen back into launch-state economics?

  2. One actor now owns the denominator that decides what the next donation, fee event, or reserve-side value unit means

    • A single supplier, or a nearly single supplier, now controls how the next exchange-rate jump, liquidityIndex increment, or accumulator increase gets capitalized.
    • This is a stronger and more dangerous state than mere illiquidity: the protocol is implicitly letting one actor define the meaning of future reserve-side value.

  3. That printed value is already allowed to matter as system truth

    • Redemption math, borrow power, liquidation logic, or sibling markets are already willing to honor the distorted mark as redeemable or borrowable value.
    • This is the decisive promotion, because a dust market only becomes systemically expensive once the rest of the protocol agrees to spend against it.

Healthy design keeps these three states visibly separate instead of flattening them into low-liquidity market.

  • Detection heuristics:
    • Review every market launch path: can totalSupply ever return to zero, or can a fresh reserve become collateral-eligible before any protective seed deposit lands?
    • Treat direct underlying transfers into a receipt-token contract as potentially adversarial, not benign donations.
    • Treat fee accrual inside an empty rebasing reserve as potentially adversarial too; ask who captures the first flash-loan fees and how much index growth one supplier can monopolize.
    • Simulate redemptions when totalSupply is single-digit wei and accounting value is very large; most catastrophic precision bugs only appear there.
    • Compare economic intent against integer math in redeemUnderlying, burn paths, liquidation seize calculations, and exchange-rate or index conversions.
    • Audit market listings as a portfolio: an empty low-liquidity market can be weaponized to steal from liquid sibling markets.
    • Separate empty market printed a huge supplier-side value and under-burned the receipt token from fresh wrapper collateral printed a huge mark that reciprocal borrow-side math later floored to zero: the first belongs here, while the second is usually the sharper inverse-price-floor-to-zero family.
  • Defenses:
    • Seed markets with non-burnable minimum liquidity or dead shares so totalSupply can never approach zero, and do not launch fresh reserves without that seed in place.
    • Prevent raw balance donations from immediately changing solvency-critical exchange-rate inputs, or account for them separately.
    • In rebasing-reserve designs, quarantine new markets with collateral factor 0 until the reserve has real deposits and fee accrual cannot be monopolized by one supplier.
    • Add minimum share-burn floors or safer rounding around redemptions in tiny-supply states.
    • Disable or quarantine empty markets before they can be used as collateral.
    • Review duplicate or unused markets aggressively; operational clutter can become exploitable structure.

What sound design looks like

  • A market is either in a launch / fresh / effectively-fresh state or in a mature state, and that lifecycle classification is enforced in code rather than left to ops convention. If supplier breadth collapses back to dust, the market falls back into quarantine automatically.
  • Solvency-critical marks only move when value enters through matched accounting paths. Direct donations, over-repayments, rescue transfers, fee recycling, and accidental raw-balance changes do not get to redefine collateral truth unless the design explicitly wants that and can prove the new supplier claims are proportional.
  • Receipt-token burn math is monotone with economic value even at pathological supply sizes: redeeming more underlying always destroys enough supplier state, and the protocol never lets floor division turn ~2 wei of required burn into 1 wei just because exchange rate or index value became enormous.
  • Borrow-side admission lags behind local accounting initialization. A new, dormant, duplicated, or recently reactivated market can accumulate seed liquidity and stabilize its internal accounting before any sibling market is forced to trust it as collateral.
  • Empty-state handling is explicit about which promotion has happened: the market is economically empty again, one actor can monopolize the denominator, and that denominator still has authority to set redeemable or borrowable truth should be different security states rather than one blurred low-liquidity condition.
  • Reserve revenue socialization assumes adversarial emptiness. Flash-loan premiums, utilization fees, and rebasing-index growth have minimum-liquidity thresholds, caps, treasury routing, or other guards so that one dust supplier cannot monopolize the next unit of value.
  • The protocol has one coherent answer to what is the denominator of supplier value right now? Real token balance, accounting balance, exchange rate, liquidity index, and collateral mark should reconcile under the same state machine rather than drifting across different entrypoints.
  • Dormant or duplicate markets are treated as latent launch surfaces, not harmless clutter. If a market no longer has healthy breadth, either seed it again, quarantine it, or remove its ability to influence systemwide solvency.
  • The target invariant is simple: no actor should be able to turn a tiny-supply market into system-relevant collateral truth faster than the protocol can force proportional share issuance, proportional share burn, or a fail-closed quarantine.

Failure-prevention checklist

  • Never let a lending market, reserve, or wrapper-backed collateral path become borrow-relevant while totalSupply, scaledTotalSupply, or equivalent supplier state is still attacker-ownable dust.
  • Treat market is economically empty, one actor owns the next unit of supplier-side value, and that value still counts as redeemable or borrowable truth as separate states in code, monitoring, and incident response.
  • Seed non-burnable minimum liquidity before collateral admission, and encode that floor so it cannot be undone later by a redeem path, migration path, or emergency cleanup.
  • Treat direct donations, over-repayments, rescue transfers, fee accrual, and any off-path balance increase as solvency code. Decide explicitly whether they should change exchange rate, supplier index, treasury balance, or none of the above.
  • Keep actual balance, accounting balance, exchange rate, liquidityIndex, and collateral valuation on one coherent story. If one path reads raw token balance while another reads scaled accounting state, document and test the boundary as hostile.
  • Fail closed in empty or near-empty states: no collateral credit, no flash-loan fee socialization, no donation-driven mark updates, and no redemptions whose rounding becomes attacker-favorable only because supply is microscopic.
  • Require market-launch sequencing to be technically enforced rather than operationally hoped for: seed first, verify state parity second, enable collateral and borrowing last.
  • Quarantine dormant, duplicate, or long-unused markets the same way you quarantine fresh ones. An old market with dust supply is still a launch-state market from the attacker’s point of view.
  • Fuzz mint / redeem / withdraw / liquidation / flash-loan settlement math at single-wei and low-decimal edge states, not only at normal TVL.
  • Add monitoring for production-impossible states: one meaningful supplier, totalSupply near zero, sudden exchange-rate jumps, extreme index growth, or a reserve whose real balance materially outruns the denominator used for collateral math.
  • Put blast-radius limits under the market anyway: borrow-side quarantine, per-market caps, temporary collateral factor 0, and fast pause paths should stop one tiny-supply accounting lie from draining sibling pools.

Audit prompts

  • What exact variable becomes borrow truth in the empty state here: Compound-style exchange rate, Aave-style liquidityIndex, an accumulator, or some wrapper-mark derivative of one of those?
  • Can an attacker drive supplier state back toward zero after launch, or does the protocol only think about the initial deployment moment?
  • Which paths increase the numerator without minting proportional supplier claims: direct transfer, over-repayment, flash-loan fees, fee harvest, donation, reward settlement, or migration bookkeeping?
  • Which paths burn supplier state, and where does floor division silently under-burn when unit price becomes absurdly large?
  • Does collateral admission depend on raw token balance, accounting balance, or a published exchange-rate/index snapshot? Can those diverge for even one transaction?
  • Can the manipulated market unlock borrowing from deeper sibling markets immediately, or is there a borrow-side quarantine that contains the damage locally?
  • Which exact empty-state promotion is happening at each step: economically empty again, attacker-owned denominator, or full redeem / borrow / liquidation authority for the printed mark?
  • If the reserve is new, dormant, duplicated, or governance-listed, what exactly guarantees that seed liquidity and collateral-disable sequencing happen before any outside actor can interact?
  • Are flash-loan fee routing and donation handling economically neutral in tiny-supply states, or do they become attacker-controlled collateral printers?
  • What invariant proves the protocol cannot credit more redeemable or borrowable supplier-side value than economically entered through matched accounting paths?
  • Which operational controls would actually catch this early: dust-supply alerts, collateral-factor guards, market-freeze automation, reserve-delta reconciliation, or per-block growth clamps on exchange rate / index variables?

Lessons that should already be standard

  • Empty markets are privileged accounting states, not harmless low-usage corners. Whoever controls the dust supply often controls the meaning of future yield, donations, and collateral value.

  • This market is nearly empty, this actor owns the denominator, and the rest of the protocol will spend against that printed value are three different security claims.

  • Collateral factor > 0 before real supplier breadth exists is a launch bug, not an aggressive growth tactic.

  • Donation neutrality is not optional plumbing. If unsolicited balance growth can instantly become collateral truth, the protocol is delegating solvency to whoever can move tokens into the contract cheapest.

  • Precision-loss edges are only small at normal scale. Once a protocol lets one wei of receipt supply represent real money, rounding becomes treasury risk.

  • Operational sequencing is part of the security model. A manual plan to seed later, burn later, or raise collateral later is not a defense if an attacker can reach the market first.

  • Dormant markets deserve the same paranoia as fresh ones. The exploit family does not care whether the unsafe empty state is five minutes old or five months old.

  • Cross-market lending makes local accounting lies systemic. A tiny market should never be allowed to define borrow power for the rest of the book without extra quarantine.

  • If a design depends on nobody will ever be the only meaningful supplier when value is socialized, then the design is incomplete until code enforces that assumption.

  • High-signal incidents:

Internal linkages

Control surface

Graph View

Backlinks