035.md

Bitter Rouge Alpaca

High

First deposit bug

Summary

When cToken.totalSupply() == 0, an attacker can make the first deposit in a way that leads stealing of funds of other depositors. This is popularly known as first deposit bug. Since Numa cToken is fork of compound cToken, the same bugs inherited into the Numa cToken as well.

https://github.com/sherlock-audit/2024-12-numa-audit/blob/ae1d7781efb4cb2c3a40c642887ddadeecabb97d/Numa/contracts/lending/CToken.sol#L522

Root Cause

The issue is already explained in detail here.

Internal pre-conditions

1. Requires initial cToken.totalSupply()to be 0
2. And subsequent users deposits

External pre-conditions

No response

Attack Path

No response

Impact

Stealing funds of initial depositors

PoC

https://github.com/akshaysrivastav/first-deposit-bug-compv2/blob/main/test/Attack.ts

Mitigation

Mint initial liquidity to address(0), similar to uniswap