---
name: evm-vault-accounting
description: Investigate ERC-4626 and vault accounting: share/asset conversions, donation effects, rounding, fees, debt, liquidation and asynchronous settlement. Use for a vault or lending-vault target with source available; not as a generic audit of every blockchain.
---

# Vault accounting specialist

This native guide routes to Dacian's published Base and Amy primers. They are expert reference
material, not independently verified findings about this target. See SOURCES.md.

## Load only the relevant knowledge

Identify the vault type and the specific value-moving operation. Search the headings of
`references/amy.vault.erc4626.primer.md` for the relevant topic, then read those sections and their
examples. Use `references/base.primer.md` for lending, liquidation, oracle or signature context
that the operation actually needs. Do not load the entire 300 KB Amy primer by default.

## Reconstruct the accounting

1. Bind source to the deployed implementation, proxy/configuration, chain and relevant block.
2. Name the actor, asset/share/debt units, rounding, fees, and all external reads or callbacks.
3. Trace `deposit/mint` against `withdraw/redeem`, including previews, limits and actual execution.
4. List every writer of total assets, supply, debt and accrued fees; include donations, yield/loss,
   admin changes, emergency exits, and pending settlement. State which are supported by this protocol.
5. Derive one concrete conservation or entitlement property from the design. Include legitimate
   yield, fees and losses so that intended behavior cannot look like a violation.
6. Construct the smallest local test and verify final balances and claims with an independent oracle.

## Calibration that takes precedence over reference shorthand

- For ERC-4626, distinguish exact-assets `deposit` (shares rounded down), exact-shares `mint`
  (assets rounded up), exact-assets `withdraw` (shares rounded up), and exact-shares `redeem`
  (assets rounded down). Previews, conversions and maximums have different fee/limit semantics.
  Check the actual standard and implementation; do not treat those methods as interchangeable.
- A donation, rounding difference, or nonstandard token is not automatically a bug. Establish an
  admissible token, reachable state, the actual protection, and an attributable loss or other eligible harm.
- First/last participant, empty supply, repeated tiny operations, and a loss before settlement are
  useful boundary cases only when their prerequisites can occur. Bound any amplification by costs.
- Multiplying before dividing may overflow; use a mathematical reference that does not duplicate
  the implementation's precision or width error. Reverts are not unsigned wraparound by default.
- A valid alternative signature is not the ability to sign an arbitrary message. Trace actual replay,
  nonce, domain, signer, and message binding before drawing a signature-related conclusion.
- The primer's vulnerable/secure snippets are examples, not verdicts. Trace this target's callers,
  guards, integration assumptions and runtime behavior. Do not force an expected pattern onto the code.

Record: the violated property, concrete before/after balances, minimal call sequence, costs and
prerequisites, counterexample/control, source locations, and unknowns. Use evm-proof-of-impact
when a Foundry reproduction is appropriate, then fp-check before a report-ready verdict.