Coffer’s BTC pool incorrectly rounded tiny deposits to zero while still minting LP tokens, allowing an attacker to repeatedly obtain shares without providing equivalent assets. The attacker submitted thousands of minimal deposits, diluting existing liquidity providers and minting approximately $18 in illegitimate LP tokens. Coffer paused its pools on October 18, preventing further withdrawals, and deployed a fix on October 19