ERC-4626 Vulnerabilities: A Vault Security Checklist

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. An ERC-4626 vault needs checks in six areas. They are rounding that favors the vault, previews and max functions that match execution, donation defenses, fee and strategy accounting, reentrancy and token quirks, and share-price oracles.

Watch: ERC-4626 Vulnerabilities: A Vault Security Checklist 1:39

Video transcript

Integrators build on an ERC forty-six twenty-six vault's promises. Break one, and you break what sits on top.

105 findings across 32 public Guardian reports name ERC forty-six twenty-six. Four are Critical, and eight are High.

Check six areas: rounding, previews and max functions, donations, fee and strategy accounting, reentrancy and token quirks, and share-price oracles.

The standard says favor the vault. Round down when issuing shares or paying out assets, and up when computing shares to burn or assets to pull.

Max functions must reflect every cap and pause, and never revert. A Glider wrapper sized exits from Morpho Vault V2 max functions, which always return zero, so every depositor could be stuck.

If a vault reads its own balance, a donation can round a victim's shares to zero. Use virtual shares or a seed deposit, track assets in storage, revert zero-share deposits, and restrict donate functions.

A raw share price is a risky oracle. Peapods priced collateral from its balance, so a donation raised its value. Bound or smooth any raw rate.

Guardian pairs two competing audit teams with an invariant suite. On Synthetix's LP vault, that meant over 20 million runs, and a High where a decimal mismatch would have broken USDC reward claims.

Read the full checklist, then talk to Guardian about reviewing your vault before deposits arrive.

ERC-4626 is the standard interface for tokenized vaults: deposit an asset, receive shares. Integrators build on its promises, so a vault that breaks one breaks what sits on top.

In Guardian's public reports, 105 findings across 32 reports name ERC-4626 or EIP-4626. Four are Critical and eight are High.

Our ERC-4626 inflation attack guide walks through one attack step by step. This checklist covers the rest of the vault.

Rounding and Previews

EIP-4626 calls it "most secure to favor the Vault itself during calculations over its users". It sets the directions:

Function	Computes	EIP-4626
`deposit`, `previewDeposit`	Shares issued for assets provided	Should round down
`mint`, `previewMint`	Assets provided for shares received	Should round up
`withdraw`, `previewWithdraw`	Shares supplied for assets received	Should round up
`redeem`, `previewRedeem`	Assets paid out for shares returned	Should round down
`convertToShares`, `convertToAssets`	The ambiguous case	MUST round down

Previews must also hold in the same transaction. previewDeposit, for example, MUST return as close to, and no more than, the shares deposit would mint.

Interest is where previews drift. Avon's deposit accrued interest first, but its inherited previews did not, so integrators saw more shares than they got (M-03).

Sentiment's SuperPool previews also missed accrued interest (M-09).

Rounding slips too: Peapods' Fraxlend mint rounded in users' favor (M-25).

Each of the four flows rounds as in the table.
Previews run the same accrual as the action they quote.
A fuzz test asserts every action matches or beats its preview.

Limits, Pauses and Exits

The max functions MUST factor in global and user-specific limits, and MUST NOT revert. If deposits are disabled, even temporarily, maxDeposit MUST return 0.

Vaults often enforce a cap or a pause in the action and forget the getter:

Avon's maxWithdraw and maxRedeem ignored borrowed liquidity and the pause (L-09).
A Veranta tranche enforced its deposit cap, but its max getters reported no limit (L-16).
Strata's junior maxMint reverted whenever the share price fell below 1 (M-07).

Integrators face the mirror image. A Glider wrapper sized its exits from the wrapped vault's maxWithdraw (Critical).

Its target was a Morpho Vault V2. Morpho's README warns that Vault V2's max functions always return zero.

Withdrawals from Vault V2 still worked, but the wrapper read zero. The report found every depositor could be stuck permanently.

Every cap and pause is reflected in the matching max function.
Wrappers size exits from what they can actually withdraw.
Pause, unpause and a full exit are tested on a fork.

Donations and Inflation

Anyone can send assets straight to a vault. If totalAssets reads balanceOf, that donation moves the share price in one step.

The classic result is the inflation attack: the victim's shares round to zero and the attacker redeems their deposit. It reaches beyond textbook vaults:

MUX's collateral pool had a public donation function, so a victim's order could fill for 0 shares (Critical).
Peapods' LendingAssetVault let an attacker deposit 1 wei, then front-run a deposit with a donation (Critical).

Donations matter after losses too.

At Glider, a one-atom donation after a total loss reopened deposits at a dust rate. A new depositor could then take almost all later recovery (High).

The two standard fixes, a protocol seed deposit and OpenZeppelin's virtual offset, are covered in our inflation attack guide.

Virtual shares and assets, or a seed deposit, are in place.
Assets are tracked in storage, not read from balanceOf.
Any deposit that would mint 0 shares reverts.
Public donate functions are removed or restricted.

Fees and Strategy Accounting

EIP-4626 splits fees cleanly. convertToShares and convertToAssets MUST NOT include fees; the previews MUST include them.

That gap trips getters. In a Veranta tranche with fees on, withdrawing the advertised maxWithdraw could revert, because the fee pushed the share cost above the owner's balance (Info).

In 3Jane's USD3, fee shares minted at the pre-report price then grew as locked profit unlocked. Fee recipients took more than their configured cut (M-04).

The totalAssets figure is only as honest as its inputs:

Kairos valued an adapter from theoretical swap PnL, not what settlement pays, overstating NAV (High).
Synthetix's LP vault cached totalAssets, so integrators should refresh it before trusting the share value (L-13).

Override every entry point, and route each one correctly.

Rest Finance left the inherited mint at 1:1 with ETH. With its LST above ETH, shares minted cheap could exit at a profit (High).
Strata's redeem passed a share amount into withdraw, which expects assets (M-05).

A vault that allocates to other vaults inherits their risk: see vault curator risk. For harvests and rate changes, see reward accounting vulnerabilities.

Reentrancy and Token Quirks

Order matters in exits. Sentiment's SuperPool burned shares, sent the assets, then reduced its stored total (High).

A receiver that re-entered saw the gap as interest. The fix was to transfer last and add a reentrancy guard.

The asset token brings its own quirks. EIP-4626 says nothing about fee-on-transfer assets, so decide which quirks you support:

Fee-on-transfer assets deliver less than the deposit counted. Measure the balance change, or reject them.
Rebasing assets change totalAssets with no deposit.
Tokens with hooks hand control to others mid-deposit.

Our weird ERC-20 tokens checklist lists the rest. Writing the asset too? See ERC-20 vulnerabilities.

EIP-4626 draws a line here. Previews aim to be exact, so they are manipulable and "not always safe to be used as price oracles".

The convert functions may be inexact, so they "can be implemented as robust price oracles", for example with a time-weighted average price.

That depends on how the vault built them. A raw rate moves with whatever moves totalAssets.

Peapods priced its spTKN collateral from balanceOf, so a donation raised its value (Critical).

Olympus's ERC-4626 price adapter drew three notes (I-01, I-12, L-03):

convertToAssets excludes fees and slippage, so it can overstate what an exit pays.
A raw share rate is safe only if donations, harvest timing and rebases cannot move it.
Share decimals need not match asset decimals.

If the vault's rate is raw, bound or smooth it in your oracle, as the Olympus report recommends.

How Guardian Reviews Vaults

A Guardian smart contract audit pairs two competing teams with an invariant suite. The suite covers accounting and solvency, rounding and math formulas, and edge states.

For Synthetix's Auto-Compound LP Vault, Guardian ran a dual-team review plus fuzzing and invariant testing, with over 20 million runs. The case study includes a High where a decimal mismatch would have broken USDC reward claims.

Frequently Asked Questions

What are the most common ERC-4626 vulnerabilities?

Wrong rounding direction, previews that drift from execution, max functions that ignore caps and pauses, donation and inflation attacks, and fee or strategy accounting that misstates totalAssets. Integrators add one more: trusting the share price as an oracle.

Which way should an ERC-4626 vault round?

Against the user. Round down when issuing shares for assets or paying out assets for shares. Round up when computing shares to burn or assets to pull. EIP-4626 also requires convertToShares and convertToAssets to round down.

What should maxDeposit return when deposits are paused?

Zero. EIP-4626 says the max functions MUST factor in global and user-specific limits: if deposits are disabled, even temporarily, maxDeposit MUST return 0. The max functions also MUST NOT revert.

Can I use an ERC-4626 share price as an oracle?

Not without checks. EIP-4626 says previews are not always safe as price oracles; convert functions are robust only if built that way, such as with a time-weighted average. Bound or smooth any raw rate that donations or harvests can move.

Sources

Get your vault reviewed before deposits arrive

Guardian tests rounding, previews, limits and share pricing against invariants before an attacker does.

Get a quote Read the vault case study