test(fuzzing): guard YS invariant against unreachable empty-while-vesting state

[alcueca]

What

Fixes the recurring nightly-fuzz failure in test/fuzzing/InvariantTestYS.sol — Rule 14/15 (startVestingTime <= endVestingTime), which began failing once main advanced to include the yield-streaming system.

Root cause (not a regression)

The acknowledged Finding 1 (setFirstDepositTimestamp bug): setFirstDepositTimestamp() sets startVestingTime without clearing a stale endVestingTime, combined with _updateExchangeRate() not clearing vestingGains at totalSupply == 0. The bad state (start > end with vestingGains > 0) is reachable only when a vault empties to totalSupply == 0 while a vest is still active and is then re-entered.

That state is unreachable in production (deprecated vaults never fully drain, let alone mid-vest), so the source is intentionally WONTFIX. The nightly went red because the prior handler workaround let the bad state happen and then tried to repair it with a best-effort vestYield — which reverts under the contract's own guards, silently leaving the invalid state for the invariant to catch (a flaky failure that surfaced once the seedless nightly campaign found the sequence).

Change (test-only: prevention over repair)

• Withdraw handlers (withdrawYS, bulkWithdrawYS) now refuse to drain the YS vault to zero while vestingGains > 0 — leaving dust or skipping. vestYield already refuses to vest into an empty vault, so this makes totalSupply == 0 always imply vestingGains == 0, and Rule 14/15 can no longer be violated without weakening what they check for real regressions.
• Removed the dead best-effort repair (fixVestingStateAfterFirstDeposit) from both the Foundry and Medusa handlers.
• Rewrote README Finding 1 to document the rationale (prevention, WONTFIX in source).

Covers both the Foundry and Medusa YS suites (shared TellerHandler). Net −150 / +52 lines.

Verification

FOUNDRY_PROFILE=nightly forge test --match-path test/fuzzing/InvariantTestYS.sol --fuzz-seed 0x2
→ 51 passed; 0 failed   (previously 2 failed on the same seed and depth)
  invariant_startVestingTimeLEendVestingTime  PASS (256 runs, 128000 calls)
  invariant_vestingGainsIntegrity             PASS (256 runs, 128000 calls)

Same seed (0x2) and depth (256×500) as the failing nightly run #66.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR replaces a best-effort vesting-state repair in the YS fuzz handlers with a withdrawal clamp intended to prevent an acknowledged, production-unreachable empty-vault state.

• Prevents Foundry and Medusa YS withdrawal handlers from draining the vault while stored vesting gains are nonzero.
• Removes the obsolete repair function and its deposit call sites from both handler implementations.
• Documents the excluded state and WONTFIX rationale in the fuzzing README.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking fuzz-coverage gap around full withdrawals whose requested time advance completes the active vest.

The new guard stabilizes the targeted invariant and is shared by both fuzzers, but its pre-warp state check can reduce or skip a withdrawal that would be valid when the actual call executes after vest completion.

Files Needing Attention: test/fuzzing/handlers/TellerHandler.sol

Important Files Changed

Filename	Overview
test/fuzzing/handlers/TellerHandler.sol	Replaces post-deposit repair with a shared YS withdrawal clamp, but evaluates the vest before the handler's time warp and therefore suppresses valid completed-vest withdrawals.
test/fuzzing/handlers/AccountantHandler.sol	Removes the Foundry-only best-effort vesting repair without leaving a dangling caller.
test/fuzzing/medusa/handlers/AccountantHandler.sol	Mirrors removal of the obsolete repair in the Medusa accountant handler.
test/fuzzing/README.md	Documents the acknowledged source behavior and the new prevention-based fuzz-model constraint.

Sequence Diagram

sequenceDiagram
  participant F as Fuzzer
  participant H as TellerHandler
  participant A as YS Accountant
  participant T as YS Teller
  F->>H: withdrawYS(full shares, timeDelta)
  H->>A: read vestingState()
  A-->>H: "vestingGains > 0"
  H->>H: clamp shares or skip
  H->>H: warp by timeDelta
  Note over H,A: Vest may now be complete
  H->>A: sync vested assets
  H->>T: withdraw(clamped shares)
  T->>A: updateExchangeRate()
  A-->>T: realize completed vest

Loading

_{Reviews (1): Last reviewed commit: "test(fuzzing): guard YS invariant agains..." | Re-trigger Greptile}

[greptile-apps]

Clamp uses pre-warp vest state

withdrawYS clamps the amount before applying timeDelta, so a vest that completes during the requested warp is still treated as active. The handler consequently leaves dust—or skips a one-share withdrawal entirely—instead of exercising the valid completed-vest full-withdrawal path.

Knowledge Base Used: CI, Testing, and Fuzzing