[Contracts] LendingPool first-depositor share inflation/donation attack: no minimum liquidity lock

[grantfox-oss]

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Why this matters

In lending_pool/src/lib.rs, calc_shares_to_mint gives the first depositor a 1:1 allocation against read_pool_balance (the live token balance), and the share price is derived from that balance in get_share_price/calc_assets_to_redeem. A first depositor can mint 1 share, then donate tokens directly to the contract to inflate share price, so a later depositor's amount * total_shares / total_assets_before rounds down to 0 shares (rejected) or far fewer shares than deposited, letting the attacker redeem the victim's principal. No minimum-liquidity burn or virtual-shares offset is present.

Acceptance criteria

• Adopt a mitigation (e.g. burn a fixed MINIMUM_LIQUIDITY of shares on first deposit, or use virtual shares/assets offsets in calc_shares_to_mint and calc_assets_to_redeem)
• calc_shares_to_mint reverts or rounds in the pool's favor so a donation cannot zero out a subsequent depositor's minted shares
• Add a regression test where a first depositor donates tokens directly to the contract and a second honest deposit still mints fair shares and is fully redeemable
• Document the chosen invariant near calc_shares_to_mint

Files to touch

• lending_pool/src/lib.rs

Out of scope

• Redesigning the entire yield/exchange-rate model
• Changes to loan_manager interest accounting

[tosin-zoffun]

This looks like something I can handle. I have already gone over the relevant files to understand how everything fits together. I will scope the work to exactly what is asked, test it locally, and raise a PR for review this week.

[grantfox-oss]

🦊 GrantFox — @tosin-zoffun has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #1)
2. Your PR will be reviewed by the LabsCrypt maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@tosin-zoffun's PR #33 was approved and merged by @ogazboiz.

🏆 @tosin-zoffun: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (48 total points). Track your full progress on GrantFox.

👏 Great work, @tosin-zoffun! Keep contributing to LabsCrypt.