SY Genesis Vaults

As described in the ERC 5115 ERC document: https://eips.ethereum.org/EIPS/eip-5115 The exchangeRate function MUST return ExchangeRate(t_now) such that ExchangeRate(t_now) * syBalance / 1e18 = assetBalance.

And, that the exchangeRate method updates and returns the latest exchange rate, which is the exchange rate from SY token amount into asset amount, scaled by a fixed scaling factor of 1e18.

The PRICER contract however returns a rate with 8 decimals of precision, and the SY token balances are using 6 decimals as derived from the vault token decimals of 6.

Therefore the exchangeRate function is non-compliant and will almost always round to zero if adjusted by a scaling factor of 1e18.

Consider scaling the exchangeRate result by 1e10 to be compliant with the ERC 5115 standard.

Nunchi Team: The issue was resolved in PR#26.

The IDepositor interface includes a deposit function interface that is supposed to include returndata for a uint256 value, however the implementation of the DEPOSITOR at the address 0x0868A605661440e5D58453f16BDB64795B2Da176 on HyperEVM does not return anything.

This ultimately results in a decoding revert as no return data was provided while some was expected, thus DoSing the entire deposit flow.

Remove the uint256 return value from the IDepositor interface.

Nunchi Team: The issue was resolved in PR#26.

The deposit function in the SYBaseUpgV2 contract is payable, however the overridden _deposit function in the NunchiHyperbeatVaultSY contract does not handle msg.value.

Add a validation in the _deposit function to revert if nonzero msg.value has been provided.

Nunchi Team: The issue was resolved in PR#26.

getTokensIn() returns a static array [VAULT_TOKEN, USDC, USDT0] for simplicity while deposit validation uses DEPOSITOR.isDepositToken().

If DEPOSITOR changes supported tokens, integrators relying on getTokensIn may route deposits to unsupported tokens and revert, degrading UX and composability.

Keep getTokensIn synchronized with DEPOSITOR.isDepositToken, or remove/hard-deprecate the static list and instead expose a function that queries the depositor’s current set. Document that getTokensIn is non-authoritative if kept.

Nunchi Team: Acknowledged.

The SYBaseUpgV2 contract implements a receive function, however there is no rescue logic to recover any Ether that may have been accidentally sent to the contract.

Consider if a rescue function should be implemented.

Nunchi Team: The issue was resolved in PR#26.

The previewDeposit function does not take into account the deposit cap that is implemented on the underlying Depositor contract, and as a result this can be misleading for any consumers of this function.

Consider checking the Depositor for the deposit cap to surface to the user whether the requested deposit will fail.

Nunchi Team: The issue was resolved in PR#26.