@@ -6,10 +6,10 @@ image: "/assets/guides/erc4626-vaults.jpg"
6
6
7
7
## TL;DR:
8
8
9
- - ** ERC4626 standardizes tokenized vaults** : deposit assets, mint shares; redeem shares for assets.
9
+ - ** ERC4626 standardizes tokenized vaults** : deposit assets, mint shares, then redeem shares for assets.
10
10
- ** Security hinges on ` totalAssets() ` ** : it drives pricing for ` convertToShares ` /` convertToAssets ` .
11
11
- ** Top risks** : first-depositor inflation, reentrancy, fee-on-transfer/rebasing tokens, oracle manipulation, rounding drift.
12
- - ** Custom features** (fees, caps, queues, RBAC) add complexity—design cautiously, test heavily.
12
+ - ** Custom features** (fees, caps, queues, RBAC) add complexity. Design cautiously, test heavily.
13
13
- ** Build with audited libs** , implement CEI + reentrancy guards, and write invariants/fuzz tests.
14
14
15
15
---
@@ -29,7 +29,7 @@ Core interface highlights:
29
29
30
30
![ ERC4626 asset/share flow with strategy yield loop] ( /assets/guides/erc4626-asset-share-flow-diagram.png )
31
31
32
- _ Figure: ERC4626 flow— deposit assets to mint shares; redeem shares to withdraw assets; strategies feed yield back to the vault._
32
+ _ Figure: ERC4626 flow: deposit assets to mint shares, redeem shares to withdraw assets, and strategies feed yield back to the vault._
33
33
34
34
---
35
35
@@ -51,7 +51,7 @@ Best practices:
51
51
52
52
![ Sequence: deposit/redeem using totalAssets with oracle sanity checks] ( /assets/guides/erc4626-totalassets-oracle-sequence-diagram.png )
53
53
54
- _ Figure: totalAssets() drives conversions; oracle reads should be sanity-checked and resistant to manipulation._
54
+ _ Figure: totalAssets() drives conversions, and oracle reads should be sanity-checked and resistant to manipulation._
55
55
56
56
---
57
57
@@ -70,62 +70,62 @@ _Figure: totalAssets() drives conversions; oracle reads should be sanity-checked
70
70
<tr>
71
71
<td><strong>Share Price Manipulation</strong></td>
72
72
<td>First depositor mints 1 share, then sends large assets directly</td>
73
- <td>Subsequent users get tiny shares; attacker exits with most assets</td>
74
- <td>Seed with non-trivial liquidity; virtual shares/assets; min deposit; make `totalAssets()` robust</td>
73
+ <td>Subsequent users get tiny shares and the attacker exits with most assets</td>
74
+ <td>Seed with non-trivial liquidity, use virtual shares/assets, require a minimum deposit, and make `totalAssets()` robust</td>
75
75
</tr>
76
76
<tr>
77
77
<td><strong>Direct Transfers to Vault</strong></td>
78
78
<td>Assets sent to vault address outside `deposit()`</td>
79
79
<td>Skews `totalAssets()` and share pricing if not reconciled</td>
80
- <td>Reconcile external transfers; ignore unsolicited assets or treat via controlled accounting</td>
80
+ <td>Reconcile external transfers, ignore unsolicited assets, or handle them with controlled accounting</td>
81
81
</tr>
82
82
<tr>
83
83
<td><strong>Reentrancy</strong></td>
84
84
<td>ERC777 hooks or external calls inside hooks</td>
85
85
<td>State corruption, theft</td>
86
- <td>CEI pattern; `nonReentrant`; minimize/ guard external calls</td>
86
+ <td>Follow CEI and `nonReentrant`, and minimize or guard external calls</td>
87
87
</tr>
88
88
<tr>
89
89
<td><strong>Hook-based Reentrancy</strong></td>
90
90
<td>Custom `beforeWithdraw`/`afterDeposit` hooks call out</td>
91
91
<td>Cross-function reentry into sensitive logic</td>
92
- <td>Avoid external calls in hooks; or guard hook paths with `nonReentrant` and strict CEI</td>
92
+ <td>Avoid external calls in hooks, or guard hook paths with `nonReentrant` and strict CEI</td>
93
93
</tr>
94
94
<tr>
95
95
<td><strong>Non-standard Assets</strong></td>
96
96
<td>Fee-on-transfer or rebasing tokens</td>
97
97
<td>Price drift, accounting mismatches</td>
98
- <td>Use actual-received amounts; adapt math to rebasing; prefer wrapped or disallow</td>
98
+ <td>Use actual-received amounts, adapt math to rebasing, and prefer wrapped tokens or disallow incompatible assets </td>
99
99
</tr>
100
100
<tr>
101
101
<td><strong>Oracle Manipulation</strong></td>
102
102
<td>Spot price manipulation or downtime</td>
103
103
<td>Cheap mints / expensive redemptions</td>
104
- <td>Decentralized oracles; TWAPs; deviation checks; circuit breakers</td>
104
+ <td>Use decentralized oracles, TWAPs, deviation checks, and circuit breakers</td>
105
105
</tr>
106
106
<tr>
107
107
<td><strong>Rounding & Precision</strong></td>
108
108
<td>Integer division in conversions</td>
109
109
<td>Dust accumulation, unfairness</td>
110
- <td>Multiply before divide; conservative rounding; fuzz tests</td>
110
+ <td>Multiply before divide, use conservative rounding, and add fuzz tests</td>
111
111
</tr>
112
112
<tr>
113
113
<td><strong>DoS & Gas</strong></td>
114
114
<td>Complex strategies in deposit/withdraw</td>
115
115
<td>TX failures under load</td>
116
- <td>Optimize strategies; isolate heavy ops; profile gas</td>
116
+ <td>Optimize strategies, isolate heavy operations, and profile gas</td>
117
117
</tr>
118
118
<tr>
119
119
<td><strong>Malicious Token Behavior</strong></td>
120
120
<td>Tokens revert/blacklist on `transfer/transferFrom`</td>
121
121
<td>Deposits/withdrawals can brick</td>
122
- <td>Vet assets; use `SafeERC20`; allow admin to disable/ unwrap problematic tokens</td>
122
+ <td>Vet assets, use `SafeERC20`, and allow admins to disable or unwrap problematic tokens</td>
123
123
</tr>
124
124
<tr>
125
125
<td><strong>MEV Timing / Front-running</strong></td>
126
126
<td>Front-running deposits before a large, profitable `harvest()` and back-running withdrawals immediately after</td>
127
127
<td>Attacker captures yield without long-term risk, diluting returns for legitimate LPs</td>
128
- <td>Smooth accruals over time; use private transactions for harvests (e.g. , Flashbots); short-term withdrawal lockups/ fees</td>
128
+ <td>Smooth accruals over time, use private transactions for harvests (for example , Flashbots), and consider short-term withdrawal lockups or fees</td>
129
129
</tr>
130
130
</tbody >
131
131
</table >
@@ -144,7 +144,7 @@ _Figure: totalAssets() drives conversions; oracle reads should be sanity-checked
144
144
145
145
![ Customization flow: caps, harvest, fee accrual/sweep, RBAC controls] ( /assets/guides/erc4626-customization-caps-fees-rbac-diagram.png )
146
146
147
- _ Figure: Customization flow with caps, fee accrual/ sweep, and RBAC controls._
147
+ _ Figure: Customization flow with caps, fee accrual and sweep, and RBAC controls._
148
148
149
149
## 5. Solidity Example: Guarded Deposit/Withdraw Skeleton
150
150
@@ -198,7 +198,7 @@ contract SecureVault is ReentrancyGuard {
198
198
199
199
![ CEI + nonReentrant deposit/withdraw with previews and token transfers] ( /assets/guides/erc4626-cei-nonreentrant-sequence-diagram.png )
200
200
201
- _ Figure: CEI + nonReentrant skeleton— previews drive pricing; token transfers occur after state calculations._
201
+ _ Figure: CEI + nonReentrant skeleton: previews drive pricing, and token transfers occur after state calculations._
202
202
203
203
### Mini Snippets: Roles and Fee Sweep (Illustrative)
204
204
0 commit comments