Skip to content

fix(vault): verify ERC-4626 operation state effects - #102

Open
makemake-kbo wants to merge 6 commits into
masterfrom
makemake/eng-4234-fixvault-verify-erc-4626-operation-state-effects
Open

fix(vault): verify ERC-4626 operation state effects#102
makemake-kbo wants to merge 6 commits into
masterfrom
makemake/eng-4234-fixvault-verify-erc-4626-operation-state-effects

Conversation

@makemake-kbo

Copy link
Copy Markdown
Contributor

Summary

  • verify receiver/owner share deltas, total supply, and underlying movement for deposit/mint/withdraw/redeem
  • remove the unbounded generic preview deviation; each concrete adapter now pins its supported exact bound
  • add assertion-executing honest and malicious state-effect regressions

Validation

  • pcl test --match-contract ERC4626PreviewAssertionTest (7 passing)
  • Curve and Spark profiles build offline

Linear: ENG-4234

@linear-code

linear-code Bot commented Aug 3, 2026

Copy link
Copy Markdown

ENG-4234

Comment thread test/protection/vault/ERC4626PreviewAssertion.t.sol
Comment thread src/protection/vault/ERC4626PreviewAssertion.sol
Comment thread src/protection/vault/ERC4626PreviewAssertion.sol Outdated
Comment thread test/protection/vault/ERC4626PreviewAssertion.t.sol

@lean-apple lean-apple left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment thread src/protection/vault/ERC4626PreviewAssertion.sol Outdated
Comment thread src/protection/vault/ERC4626PreviewAssertion.sol
PhEvm.CallFilter memory filter = PhEvm.CallFilter({
callType: 0, minDepth: 0, maxDepth: type(uint32).max, topLevelOnly: false, successOnly: true
});
PhEvm.TriggerCall[] memory calls = ph.matchingCalls(vault, ctx.selector, filter, 8);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Capping this lookup at eight makes the ninth valid deposit or mint in one transaction revert because its call id can never be found. That turns the performance bound into an undocumented protocol restriction. Could we either resolve the caller without a global prefix scan or explicitly enforce and document a supported call count at registration?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants