If you're shipping an ERC-4626 vault, there's one attack you need to understand before mainnet — because it targets your **very first real depositor** , and it's caused by a rounding detail that's easy to miss. It's called the **first-depositor inflation attack** (or "empty-vault share inflation"). Here's how it works, in plain English. ## The setup: shares vs. assets An ERC-4626 vault issues **shares** representing a claim on the underlying **assets**. The exchange rate is roughly: shares_you_get = deposit_amount * total_shares / total_assets When the vault is brand new, `total_shares` and `total_assets` are both zero, and the first deposit sets the initial rate. That empty starting state is the vulnerability. ## The attack, step by step 1. **Attacker deposits 1 wei.** The vault mints them 1 share. Now `total_shares = 1`. 2. **Attacker "donates" a large amount directly** to the vault — a raw `transfer` of, say, 10,000 tokens straight to the vault address, _not_ through `deposit()`. Now `total_assets = 10,000e18 + 1`, but `total_shares` is still `1`. 3. **One share is now worth ~10,000 tokens.** 4. **The victim deposits 10,000 tokens** expecting a fair share. The share math rounds _down_ : `shares = 10,000e18 * 1 / 10,000e18 ≈ 1`, but integer rounding gives them **0 shares** (or far fewer than they paid for). 5. The attacker now owns a share worth the victim's deposit. They **redeem and walk away** with the victim's money. The victim did nothing wrong. They deposited into a vault whose accounting could be manipulated because it trusted `balanceOf(address(this))` and started from empty. ## Why it happens Two ingredients: * **Accounting from raw balance.** Using `token.balanceOf(address(this))` as `total_assets` lets anyone inflate it with a direct transfer (a "donation"), bypassing `deposit()`. * **Rounding that favors the vault/attacker** on the first deposit, when supply is tiny. ## The fix: virtual shares & assets (decimal offset) OpenZeppelin's ERC-4626 implementation defends against this with **virtual shares and virtual assets** — it adds a small virtual offset to both sides of the ratio so the vault never really starts from zero, and rounding always favors the vault over the attacker rather than the reverse. In practice: * Use **OpenZeppelin's`ERC4626`** as your base (it ships the `_decimalsOffset()` mitigation). * If you roll your own, **don't derive`totalAssets` from raw `balanceOf`** — track deposited assets internally, or add the virtual-offset defense. * Consider **seeding the vault** with a tiny initial deposit at deployment (a "dead shares" burn) so it's never empty for the first real user. * Add an **invariant/fuzz test** : "a depositor never receives 0 shares for a non-trivial deposit," and "no sequence of donate+deposit lets one account extract another's assets." Solmate's minimal ERC-4626, by contrast, **intentionally omits** this — it leaves the defense to the integrator. That's a valid library choice, but it means _you_ have to add it. (My scanner flags exactly this difference between the two.) ## Check your vault in one command OpenClaw Audit has a dedicated first-depositor-inflation detector, plus checks for donation-based accounting (`balanceOf(address(this))`) and ERC-4626 rounding direction: pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit <your-vault-repo> Heuristic candidates — verify before acting. But for a vault, this is one of the first things to rule out. _Building an ERC-4626 vault and want a human to check the share math before you ship? A hand-verified Quick Scan is $49 (one contract, 48h, and if it's not useful you don't pay)._

Aave Labs has launched Stable Vaults, an ERC-4626-based product that lets wallets, exchanges and payment apps offer stablecoin yield on USDC, USDT and GHO without exposing users to blockchain mechanics directly. The vaults route deposits into vetted DeFi lending strategies and...

A self-sustaining economic bridge between the gig economy and real-world assets.

In a promising development for the Ethereum ecosystem, a new Ethereum Improvement Proposal (EIP) has surfaced, bearing the code EIP-7540

Cross-chain deposit aggregator for ERC-4626 and custom yield vaults

넥써쓰는 23일 원체인에 스테이킹된 원을 유동화하는 리퀴드 스테이킹 토큰 에스티원을 출시했다. 에스티원은 스테이킹 보상을 유지하며 자산을 거래할 수 있게 하며 ERC-4626 표준을 적용했다. 이용자는 원스테이킹 페이지에서 원을 에스티원으로 전환할 수 있고 향후 원렌딩의 담보 자산으로 활용될 예정이다. 넥써쓰 장현국 대표는 이번 출시를 통해 원의 생태계가 ...

## Vaults, shares, and price ERC-4626 gives tokenized vaults a common interface for deposits, withdrawals, and share accounting. A user deposits an ERC-20 token and receives shares representing a claim on the vault's underlying holdings. The vault might lend those assets, stake them, or put them into another yield strategy. Users can later redeem their shares and, where the vault allows it, transfer them to someone else. In a simple proportional model, a user's shares divided by total shares, multiplied by the vault's assets, gives their claim on those assets. Actual redemption amounts also depend on the implementation, including rounding, fees, and any virtual assets and shares used in the calculation. I called this project "Vault Price Honesty" because I wanted to examine what those exchange rates mean for the people using a vault. The name needs a little care: an unexpected price change is not enough to call the accounting wrong. A direct donation, for example, can raise the value of existing shares without harming a later depositor. I focused on five situations: 1. **A tiny first deposit followed by a donation.** Someone acquires a small number of shares, then transfers tokens directly into the vault. The resulting exchange rate can leave the next depositor with very few shares, or none. Whether the first depositor profits needs a separate calculation. 2. **Assets remaining when no shares exist.** This can happen after the last redemption or because someone donates to an empty vault. How the next deposit is priced depends on the implementation. The two situations are worth testing separately. 3. **Direct donations counted as assets.** Including donated tokens in the vault's accounting raises the value of existing shares. That can be intended behavior; the question is what follows from it. 4. **Preview and execution disagreeing.** Previews have specific requirements under ERC-4626. A difference needs to be checked against those requirements before it is called a violation. 5. **Reported assets and assets held at the vault address differing.** A strategy may hold assets elsewhere, so the difference can be legitimate. Stale or incorrect valuation is a separate concern. ## Following the tokens I started this project intending to build a reusable, hardened ERC-4626 base contract. Working through the cases made the scope less straightforward than I expected. Donation accounting, strategy valuation, and the treatment of assets remaining after the last redemption depend on the vault's design. Shared protections are useful, but they do not settle all of those choices. I shifted the project toward a Foundry suite for examining that behavior. One local test made the reason particularly clear. A user deposited 50 tokens and received zero shares. Before that deposit, an attacker had deposited one base unit of an 18-decimal token, then transferred 10,000 tokens directly into the vault. This fixture uses an OpenZeppelin-based vault with a decimals offset of zero. The depositor's loss was clear. The attacker's position needed another calculation. Participant | Contributed | Redeemable | Net ---|---|---|--- Attacker | 10,000 + 1 wei | Approximately 5,025 | Approximately −4,975 Depositor | 50 | 0 | −50 These are underlying-token amounts in a local fixture, excluding gas. The attacker's initial deposit was one base unit, not one whole token. OpenZeppelin's virtual asset and share accounting explains the result: part of the donation cannot be recovered by the attacker. In this particular sequence, causing a depositor to lose 50 tokens costs the attacker roughly 4,975 tokens. The depositor suffered a complete loss, but this sequence did not generate an attacker profit. It demonstrates griefing. It does not establish the economics of other donation amounts, multiple victims, or a different vault implementation. The local inflation test also includes an OpenZeppelin-based vault with a decimals offset of three. With the same initial attacker deposit, donation, and victim deposit, the victim receives shares redeemable for approximately 45.02 tokens. That avoids the zero-share outcome, but still leaves the victim almost 10% short. A test asserting only that the victim received shares would miss that loss. Comparing raw share counts between the two vaults would also be misleading because the offset changes share precision. The useful comparison is the amount of underlying assets those shares can recover. Another local case starts with zero shares and 500 donated tokens already in the vault. The next user deposits 1,000 tokens and receives shares redeemable for 750. Here, too, a nonzero share balance conceals a substantial loss. This setup deliberately donates assets to an empty vault; it should not be confused with a normal redemption leaving a small rounding remainder. ## Interpreting the other measurements Direct donations require more care. In the recorded fork run, transferring underlying tokens into sUSDe increased its reported assets and share value. That observation alone does not establish depositor harm. A higher price per share can mean that each share represents more assets. To make a stronger claim, I would need to follow a specific consequence: a depositor's round trip, a fee calculation, or an integration using that price as collateral value. The donation test does not demonstrate those outcomes. The same caution applies to `totalAssets()`. Assets deployed through a strategy need not appear in the underlying token balance at the vault address. A difference between the two numbers is a starting point for examining the accounting. Establishing an error requires understanding what the vault owns and how it values those positions. Preview checks have a more explicit reference: the ERC-4626 specification. When a preview is followed by the corresponding operation in the same transaction, under unchanged conditions, deposit and redeem must return at least their previewed amounts; mint and withdraw must require no more than theirs. The standard also requires previews to approximate the operation as closely as specified. Simple equality with `convertToShares` or `convertToAssets` is not a general substitute, since previews account for factors such as fees. These checks need evidence from execution, including balance changes. A returned number is insufficient if the corresponding assets never arrive. ## What I would use the report for The local fixtures make particular sequences easy to inspect. Fork tests add real accounting structures and operational restrictions. Their conclusions remain limited to the paths actually exercised: the live tests cover deposit previews and redeem where possible, rather than all four operations. Empty-vault scenarios stay local for the populated vaults in the sample. An unsuccessful run leaves a coverage gap; it does not identify the cause of failure. For a developer reviewing a result, I want the report to answer three questions: what operation ran, what changed, and which conclusion those measurements support. A standards violation, a demonstrated economic loss, and a design-dependent behavior each call for a different response. The most useful result from this work was the small table above. It shows both the depositor's loss and the attacker's cost. Those two numbers say more about this particular attack than the zero-share result alone. The Foundry project, tests, and reports are on GitHub. The suite is a focused investigation tool, not a comprehensive audit.

> _Note: This technical write-up was created for the purposes of entering the Google Cloud & Devpost #AllThingsAgenticHackathon._ ## 1. The Problem Traditional smart contract security linters generate high false-positive rates while failing to catch deep, multi-block economic invariant breaks—such as ERC-4626 vault share inflation, lending pool bad debt, and low-float governance attacks. ## 2. Technical Architecture & Google Tech Stack The **Cybernetic Security Fleet** is an autonomous 133-module auditing rig designed to automate the discovery, invariant fuzzing, exploit proof-of-concept synthesis, and disclosure lifecycle. * **Agent Orchestration & Reasoning:** Google GenAI SDK orchestrating Gemini and Gemma models to analyze AST graphs and generate standalone Foundry exploit code. * **Google Cloud Infrastructure:** Telemetry ingestion, compute execution, and audit artifact archiving hosted on Google Cloud Run and GCP backend services. * **Invariant & Fuzzing Engines:** Stateful execution harnesses generating zero-phantom-pass test coverage. ## 3. Key Achievements * **100% Reproducible Exploits:** Discovered invariant breaches are automatically transpiled into runnable Foundry tests. * **Instant Triage & Dispatch:** Real-time generation of markdown disclosure reports alongside Discord webhook breach notifications. * **Test Suite:** 292/292 tests passing across continuous verification pipelines. Built with Google Cloud, Gemini, and Python.

Trestle DeFi testnet is live. Earn rewards for exploring our marketplace, escrow system, and yield vaults across Polygon, Arbitrum, and Base testnets. Join 5K+ degens farming the future of…