Cowrie Research

fresh-market-initialization-failure

20 min read

Fresh-Market Initialization Failure / First-Depositor Capture

  • Name: Fresh-market initialization failure / first-depositor capture
  • Category: exploit pattern / lending-market launch failure / empty-market activation risk / sequencing bug
  • Summary: This exploit family appears when a protocol creates or activates a new market before its initialization assumptions are actually locked in onchain. If the first meaningful actor can reach the market before dead shares, seed liquidity, collateral quarantine, wrapper offsets, or other launch hardening is in place, they can define the market’s opening state for the rest of the protocol. In Compound-style forks that usually means pinning receipt-token supply near zero and then printing exchange rate with a direct donation; in Aave-style forks it means monopolizing early liquidityIndex growth in an empty reserve and sometimes even deciding which reserve ledger is allowed to become economically active first; in fresh ERC-4626 collateral integrations it can mean making a newly admitted vault share economically attacker-priced before the lending layer has any safe floor on that mark. The recurring review mistake is to collapse three different promotions into one vague market is live moment: the market exists, the first actor can already shape its opening denominator, and that opening state may already define systemwide collateral truth. A useful extension is that fresh market risk is really fresh-state risk: if a live system can be driven back toward zero supply or replay an initialization branch, bootstrap assumptions can become exploitable again long after launch. The key failure is operational as much as mathematical: the protocol treats launch sequencing or one-time initialization as if it were guaranteed, but the attacker gets there first.
  • What it is:
    • A lending market is not safe merely because its steady-state math is acceptable. It also needs a safe first state.
    • Many forks rely on launch rituals that are only partially enforced onchain: list the market, seed it, burn or lock a minimum position, then later enable collateral.
    • If those steps are split across public governance execution, separate transactions, or manual operator runbooks, an attacker may insert themselves between them.
    • Once the attacker controls the first meaningful state, the later exploit often looks familiar: empty-market exchange-rate inflation, fee-concentrated liquidityIndex inflation, or some other tiny-supply accounting distortion.
    • The distinctive feature of this pattern is that timing and sequencing are part of the exploit surface. The market is dangerous not because it is old and forgotten, but because it is new and not yet hardened.
  • Typical preconditions:
    • A market, reserve, or freshly admitted collateral wrapper can become live before an immutable seed deposit, dead shares, virtual offset, or other non-redeemable minimum liquidity is established.
    • Collateral eligibility, borrowing, or other solvency-relevant use is enabled too early, or can be enabled in a separate step from seeding or wrapper hardening.
    • Timelock, governance, or deployment execution is permissionless once a queue expires, letting arbitrary actors execute the launch path.
    • The first meaningful depositor can dominate the new market’s supply, scaled balance, index participation, or vault-share ownership.
    • A downstream accounting bug already exists and only needs an empty or attacker-controlled initial state to become profitable.
  • Common vulnerable surfaces:
    • Compound-v2 forks that list new cToken / oToken / soToken markets before dead shares or permanent seed liquidity is established
    • Aave-v2 or Aave-v3 forks that activate fresh reserves before any protected seed deposit, reserve-ledger parity check, or temporary collateral quarantine
    • ERC-4626 collateral integrations that admit a newly deployed or newly linked vault share before donation resistance, virtual offsets, or borrow-side quarantine are in place
    • governance queues where market creation, collateral-factor changes, and other launch steps are separated across public transactions
    • operator runbooks that assume the team will execute seed-and-burn steps before anyone else can touch the market
    • listing systems that let a passed proposal become immediately borrow-relevant instead of first entering a safe warm-up state
  • Exploit sequence:
    1. The attacker watches governance, deployment, or timelock execution for a new market or reserve.
    2. They become the first meaningful supplier before seed liquidity or collateral quarantine is in place.
    3. They force the market into the exact initialization state their downstream exploit needs: often 2 wei of receipt-token supply in a Compound-style fork or near-total ownership of scaled supply in an Aave-style reserve.
    4. They inflate the market’s accounting value through the protocol-specific path: direct donation, fee-concentrated liquidityIndex growth, or another empty-state-sensitive mechanism.
    5. They use the now-fake collateral value against deeper-liquidity sibling markets or redeem through attacker-favorable rounding.
    6. The protocol discovers that its real security boundary included launch sequencing all along.
  • Variants:
    • Governance-created empty market — a passed proposal lists a new market and the attacker executes or races the launch path before hardening, as in Onyx and Sonne.
    • Fresh reserve first-depositor capture — a new rebasing reserve goes live without seed liquidity, so the first depositor monopolizes index growth, as in Radiant.
    • Fresh wrapper-collateral activation — a newly deployed or newly admitted vault share becomes borrow-relevant before donation resistance, virtual offsets, or collateral quarantine make its opening exchange rate expensive to manipulate, as in ResupplyFi.
    • Manual-runbook dependency — the team knows the bug class and has a mitigation, but the mitigation lives in offchain execution order rather than enforced contract state.
    • Public-timelock split launch bundle — individually reasonable queued actions create an unsafe state machine because any post-expiry executor can realize market exists now, hardening later, as in Sonne and some listing-path replays.
    • Collateral-enabled too early — the market would be survivable if isolated, but it becomes borrow-relevant before its opening state is safe.
    • Zero-state replay / bootstrap resurrection — a live system can be pushed back toward supply == 0, prev_supply == 0, or another initialization-only state, letting launch-time assumptions become exploitable again. Yearn yETH is the sharp vault-style cousin even though it is not a lending-market listing event.

Three launch-state promotions reviewers should not collapse

  1. The market exists or can be touched locally

    • A reserve, cToken market, or wrapper-backed collateral path has been listed, deployed, or made deposit-reachable.
    • This is stronger than not launched yet, but it still only answers a local reachability question.

  2. The first meaningful actor can already shape the opening denominator

    • A user can become the first economically relevant supplier, own nearly all scaled supply, set the opening share ratio, or otherwise decide what the next donation, fee event, or wrapper mark will mean.
    • This is a separate security promotion: the protocol is implicitly deciding that the opening state is already safe enough to be attacker-shaped.

  3. That opening state may already define systemwide collateral truth

    • Sibling markets, liquidation logic, borrow caps, and collateral engines are now willing to honor the fresh market’s printed state as real solvency authority.
    • This is the most dangerous promotion in the family, because a market can be deployed or even deposit-live while still being far too fresh to underwrite the rest of the protocol.

The recurring failure is that protocols collapse all three promotions into market is live now. Healthy launch design forces each step to earn separate approval.

  • Detection heuristics:
    • Review launch paths as atomic state machines, not as optimistic runbooks. Ask exactly which onchain condition prevents a new market from being economically usable before it is hardened.
    • Trace who may execute queued governance actions after timelock expiry. If the answer is anyone, assume the attacker controls sequencing.
    • Simulate first-user behavior on every new market: can the first meaningful supplier force supply to microscopic levels or monopolize index accrual?
    • Treat collateralFactor > 0, borrow enablement, or reserve activation as security boundaries, not administrative afterthoughts.
    • Check whether market creation, seeding, and collateral activation happen atomically. If not, model the gap as adversarial.
    • Inspect queued launch bundles by prefix, not only by final intended end state. If a public executor can realize the first half of a ceremony safely enough to keep going but unsafely enough for the first user to seize the opening denominator, the launch path is already vulnerable.
    • Ask whether the protocol can ever return to a fresh state after launch: can supply be burned to dust or zero, can a reserve become effectively empty again, or can initialization-only branches be re-entered under production state?
  • Defenses:
    • Make launch hardening atomic: create the market, seed non-redeemable minimum liquidity, and keep collateral disabled until the safe opening state is already onchain.
    • Use dead shares, locked seed liquidity, or equivalent supply floors that cannot be burned back to zero by the first user.
    • Launch new reserves with collateral factor 0 or borrow-disabled state until deposits are diversified and initialization checks pass.
    • If governance is permissionless after timelock expiry, design queued actions so arbitrary execution order cannot expose an unsafe intermediate state.
    • Treat create market, seed market, and enable collateral as one security object. If they are split across a public queue, the safe property has to hold for every partial prefix an attacker can execute, not only for the team’s intended full sequence.
    • Permanently disable one-time bootstrap branches after initialization, or make them depend on an irreversible flag rather than a replayable economic state such as totalSupply == 0.
    • Treat launch procedures as protocol logic; if a mitigation only exists in team muscle memory, it is not really a mitigation.

What sound design looks like

  • Market launch is an encoded lifecycle, not a runbook

    • A healthy system can point to one explicit onchain state machine for listed, seeded, collateral disabled, collateral enabled, and any fresh-wrapper admission step instead of relying on operators to remember the right order.
    • In rebasing-reserve systems, that lifecycle should also keep raw custody balance exists, recognized reserve liquidity exists, and economically active reserve truth exists as separate stages during launch. A fresh reserve that can already flash-loan, withdraw, or publish collateral from raw aToken balance before reserve-ledger parity is established is still unfinished even if the asset is technically listed.
    • The sharper positive-design companions are fresh-market seeding and activation discipline and actual-balance and scaled-liquidity ledger coherence discipline: if the market needs a safe opening state, the transition into that state should be enforced by contract state, reserve-ledger discipline, and governor script shape rather than by timing luck.

  • First meaningful state is deliberately non-attacker-ownable

    • Dead shares, locked seed liquidity, virtual offsets, or equivalent supply floors should already be onchain before any outside actor can become the first economically relevant supplier or wrapper holder.
    • First user should be a harmless participant in an already-shaped market, not the person who gets to define what the market’s initial accounting means.

  • Collateral truth lags market existence

    • A new reserve, cToken market, or wrapper-backed collateral path can exist locally before it is trusted system-wide to set borrow power.
    • Healthy systems keep market exists, outside users may shape the opening denominator, and sibling markets may honor the resulting mark as borrow truth as separate promotions rather than one launch bit.
    • The adjacent positive-design companion is collateral-admission lag and borrow-side quarantine: opening deposits and opening solvency authority should be different states.

  • Fresh-state and effectively-fresh-state are treated the same way

    • If a live market drifts back toward one-supplier dust, near-zero supply, or bootstrap-style accounting, it should fall back into the same quarantine logic that protects day-zero launch.
    • The lifecycle-side companion is effective-freshness reclassification and dormant-market quarantine: old but empty again is still a fresh-state security problem.

  • Bootstrap logic is keyed off irreversible authority, not replayable economics

    • One-time setup should depend on a consumed initialization flag, sealed supply floor, or permanently retired launch branch rather than on totalSupply == 0, first deposit, or some other economic condition an attacker may be able to recreate.
    • Fresh wrappers, reserve initializers, and debt-share bootstrap code should become unreachable because the protocol retired that authority, not because the designers hoped production state would never resemble launch again.

  • Adversarial governance execution is part of the design target

    • If any actor can execute a queued proposal, the protocol must stay safe when the attacker is the one who presses execute first.
    • The queued object itself should already be a safe launch bundle rather than a public invitation to finish a fragile ceremony later. The sharper governance-side companion is timelock action-bundle commitment: launch safety should survive the exact ordered prefix states a public executor can realize, not only the team’s intended completed sequence.
    • The adjacent operations companion is operator experimentation separation from live balance-sheet authority: a governance listing, reserve activation, or rollout script should not double as a live money-good setter for collateral truth just because an authorized actor can press the button.
    • The adjacent positive-design companion is recursive-borrow suppression for fresh collateral: even after a market exists, newly admitted value should not be allowed to recurse immediately into same-asset or sibling-asset borrowing while the opening state is still thin and attacker-ownable.

Failure-prevention checklist

  • Treat market listed, reserve deployed, first outside actor can shape opening state, and collateral enabled as separate security states and encode the allowed transitions explicitly. A fresh market should not become borrow-relevant just because the deployment transaction succeeded.
  • Seed non-redeemable minimum supply before any outside actor can become the first meaningful supplier, and make that floor irreversible rather than dependent on later operator cleanup.
  • Keep fresh markets in a quarantine state by default: collateral factor 0, borrow disabled, or isolated-only until initialization invariants and monitoring checks pass.
  • Bundle launch steps so the same atomic action (or the same tightly constrained governor script) creates the market, seeds it, verifies its starting accounting, and only then turns on collateral or borrowing.
  • In rebasing reserves, keep raw balance present, recognized reserve liquidity, and economically active reserve truth separate during warmup. Direct transfers, first flash-loan premiums, or rescue top-ups should not become flash-loanable balance, supplier-index growth, or collateral-visible backing before the reserve has one coherent ledger story.
  • Assume timelock execution order is adversarial if anyone can execute queued proposals. The launch design must stay safe even when the attacker, not the team, is the first one to press execute.
  • Treat authorized rollout actions as scoped setup powers, not as instant live solvency authority. Listing, reserve activation, c-factor changes, and wrapper admission should graduate through quarantine rather than publish money-good collateral truth in the same step.
  • For wrapper-backed collateral, require donation resistance, virtual offsets, dead shares, or equivalent anti-first-depositor controls before the wrapper mark can influence lending solvency.
  • Prevent bootstrap-state replay. If safety depends on first deposit, first borrow, supply > 0, or another one-time condition, gate it with an irreversible initialization flag rather than with an economic state that can drift back toward zero.
  • Separate market can hold deposits from market can publish collateral truth for the rest of the protocol. A fresh reserve may be useful locally before it is safe system-wide.
  • Test launch and relaunch edges adversarially: first-supplier monopoly, dust-supply rounding, fee concentration into one scaled balance, governance-execution races, and near-zero-state returns after redemptions or migrations.
  • Put blast-radius limits under fresh listings anyway: low caps, isolated borrow power, rate limits, and fast pauses should keep one bad opening state from instantly becoming cross-market bad debt.

Audit prompts

  • What exact onchain condition proves this market is past its dangerous opening state: irreversible seed deposit, dead shares, diversified supply, explicit activation flag, or something weaker and operational?
  • Can any actor other than the intended deployer or governance executor become the first meaningful supplier, borrower, or wrapper owner before hardening finishes?
  • Which steps in the launch path are split across transactions, modules, scripts, or governance actions, and what happens if an attacker controls the order?
  • Does collateral admission wait on a real supply floor and safe accounting state, or only on a proposal bit that says the market is listed?
  • Which exact launch-state promotion is being crossed at each step here: local market existence, attacker-shapeable opening denominator, or full cross-market collateral authority? Where can one promotion happen while the next still should have stayed closed?
  • If the market uses rebasing, fee accrual, or index-based accounting, who captures the first increments when supply is microscopic or singular?
  • Can the system ever drift back into a bootstrap-like state after launch through redemptions, migrations, market dormancy, or supply compression?
  • For ERC-4626 or wrapper collateral, what prevents a first depositor or donor from defining the opening share price before the lending layer trusts it?
  • If the mitigation is we seed it right away or we execute the second step immediately, what contract invariant enforces that claim when the operator is offline or the executor is adversarial?
  • Once the fresh market publishes a manipulated value, how quickly can that value recurse into sibling borrowing, liquidations, or treasury loss?
  • Which alerts would fire if a newly listed market still had one dominant supplier, near-zero total supply, abnormal index growth, or collateral turned on before seeding was complete?

Lessons that should already be standard

  • Fresh markets are security-sensitive state machines, not administrative leftovers. Listing a market without encoding its opening-state rules is equivalent to publishing unfinished solvency logic.

  • A passed proposal or deployed reserve is still not a mature collateral object. Exists onchain, can accept the first meaningful position, and deserves cross-market borrow authority are different claims.

  • We will seed it in the next transaction is not a control. If the attacker can execute or race the gap, the gap is the exploit surface.

  • First-supplier monopoly is a balance-sheet problem, not just a UX oddity. In empty or near-empty systems, the first actor often decides what future donations, fees, or wrapper marks mean.

  • Collateral activation deserves more paranoia than deposit enablement. A market can be harmless while isolated and catastrophic the moment its locally printed value becomes borrow power elsewhere.

  • Governance and timelocks are part of market-launch code. Permissionless execution means the protocol must survive adversarial sequencing, not just honest operator sequencing.

  • Authorized listing or activation rights are still dangerous when they publish live balance-sheet truth directly. Governance approved it or ops executed the rollout is not evidence that the market has earned mature collateral authority yet.

  • Fresh-state bugs do not end at launch. If a reserve, wrapper, or market can be pushed back toward zero-state semantics, the bootstrap exploit class is still alive.

  • Wrapper admission is launch risk too. A newly admitted ERC-4626 share can be just as dangerous as a newly listed cToken market if the lending layer trusts its opening exchange rate too early.

  • If the protocol cannot state in one sentence why the first economically meaningful interaction is safe, then the protocol has not really finished the market design.

  • High-signal incidents:

Internal linkages

  • Parent accounting family: empty-market-exchange-rate-inflation — the broader mathematical exploit family this note specializes.
  • Hidden debt-market companion: debt-share-desynchronization-zero-share-borrow-inflation — useful when unsafe launch state manifests on the borrower side, with empty-market control over totalDebtShare rather than supplier-side collateral inflation.
  • Positive-design companion: fresh-market-seeding-and-activation-discipline — useful when the sharper question is what lifecycle a new or effectively-fresh market should pass through before it can define solvency for the rest of the protocol.
  • Positive-design companion: effective-freshness-reclassification-and-dormant-market-quarantine — useful when the sharper question is how an already-listed or previously active market should fall back into launch-style quarantine once low breadth, dormancy, or near-zero-state conditions make it effectively fresh again.
  • Positive-design companion: vault-share-truth-security-object — useful when the sharper question is what receipt-token, wrapper-share, or reserve-claim object should already be economically truthful before the lending layer admits it as collateral.
  • Positive-design companion: collateral-admission-lag-and-borrow-side-quarantine — useful when the main design task is keeping a new market or wrapper locally live but not yet systemically borrow-relevant.
  • Positive-design companion: actual-balance-and-scaled-liquidity-ledger-coherence-discipline — useful when the sharper launch-state question is whether a fresh rebasing reserve was allowed to turn raw aToken custody balance, first fee accrual, or direct-transfer inventory into flash-loanable or collateral-visible truth before reserve accounting and supplier-denominator state had actually converged.
  • Governance-side launch-bundle companion: timelock-action-bundle-commitment — useful when the sharper question is how a public timelock or governor queue should freeze one safe ordered launch bundle instead of exposing market exists now, harden later as attacker-controllable state.
  • Operations-boundary companion: operator-experimentation-separation-from-live-balance-sheet-authority — useful when the sharper question is why an authorized listing, reserve-activation, or wrapper-admission path was still allowed to publish live collateral truth before the market’s opening state had actually earned it.
  • Positive-design companion: recursive-borrow-suppression-for-fresh-collateral — useful when the danger is not only a manipulable opening state but that the same asset or close sibling market can immediately recurse against that fresh printed mark.
  • Strong Aave-style fresh-market case: dtrinity-dlend-cbbtc-fresh-market-liquidityindex-inflation-exploit-2026-03-17 — useful when the question is how a just-listed reserve with zero supply turns flash-loan-fee accrual into fake collateral without needing a dormant market or a Compound-style donation path.
  • Strong Acala fresh-reserve case: starlay-finance-acala-usdc-empty-market-liquidityindex-exploit-2024-02-08 — useful when the question is how launch-state danger can survive as configuration: a dust lUSDC position, unsafe collateral / liquidation conditions, and an empty reserve were enough to make recycled USDC print borrowable DOT and LDOT value.
  • Strong fresh-wrapper case: resupplyfi-cvcrvusd-donation-zero-exchange-rate-exploit-2025-06-26 — useful when the unsafe opening state sits in a newly admitted ERC-4626 collateral path rather than in a classic cToken market or Aave reserve, and the cash-out comes from inverse-price lending math collapsing to zero.
  • Adjacent pattern: donation-share-price-manipulation — similar attacker-inflated accounting value, but this note stays on launch-window and initialization control rather than vault-share exchange rates.
  • Adjacent pattern: solvency-check-bypass — both families create fake borrowable solvency, but here the critical mistake is unsafe market initialization rather than a later collateral / debt desynchronization.
  • Useful contrast: hundred-finance-hwbtc-empty-market-exchange-rate-exploit-2023-04-15 — same core empty-market arithmetic, but the opening came from a neglected live market rather than a fresh launch window.
  • Useful lifecycle cousin: yearn-yeth-near-zero-supply-bootstrap-underflow-infinite-mint-2025-11-30 — not a lending-market launch, but a strong preserved example of fresh-state risk returning after a live system is driven back to zero-supply bootstrap semantics.
  • Adjacent vault analogue: first-deposit-inflation — the same first actor controls the opening capitalization state problem when the surface is a vault or pool rather than a lending market.

Control surface

Graph View

Backlinks