We manage your security to weather the AI storm →
Get a quote

ERC-4626 and yield vault audit

A vault makes one promise: every share is worth its slice of the assets. Guardian audits the share math, the strategies behind it and every way out, with 20+ public yield vault reports.

Get a quote Read the Umami case study
20+ Public yield vault reports
150+ Criticals and Highs in those reports
25 Criticals and Highs on Peapods LVF
20M+ Fuzzing runs on Synthetix's LP vault

DeFi audits for

  • GMX
  • Synthetix
  • Orderly Network
  • Dolomite
  • Veranta
  • Olympus

Onchain · Yield Vault Audit

Every share price, every strategy, every fee.

  • Share pricing and first deposits Prices from tracked assets, not raw balances, with a seed deposit or virtual offset, and no deposit that mints zero shares.
  • Rounding direction Deposit and redeem round down, mint and withdraw round up, and no exact exit reverts by one unit.
  • totalAssets and pending PnL Open positions, claimable funding, unclaimed rewards and debts counted once, so the price does not jump when they settle.
  • ERC-4626 compliance Max and preview functions that match execution and reflect every cap and pause, convert functions that exclude fees, and no revert where the standard forbids one.
  • Async requests (ERC-7540) Pending, claimable and claimed states, cancellations, operators, and who carries a loss while a request waits.
  • Strategy adapters and integrations Callbacks, max functions, reward claims, ADL and liquidations in every external protocol a strategy calls.
  • Harvest and fee accrual Reward claims and harvests no one else can trigger or sandwich, fees on the right base, and high-water marks that only rise.
  • Withdrawal queues and cooldowns Queues, epochs, lockups and partial fills that one user cannot block, reorder or reset for everyone else.
  • Losses and recovery Who absorbs a strategy loss, and whether exits, late claims or new deposits shift it onto other holders.
  • Curator, allocator and keeper roles What managers can move, cap or rebalance, and which of those calls an attacker can trigger instead.
  • Shared strategies and multi-vaults Vaults that share a balance or a strategy, priced so one vault's shares never claim another's assets.
  • Upgrades and wrappers Balances that read the same after an upgrade, and wrappers that apply each share conversion once.

Covers ERC-4626 and ERC-7540 vaults, auto-compounders, delta-neutral and leveraged strategy vaults, and wrappers over Morpho, Aave and GMX on Ethereum, L2s and HyperEVM. Keepers that harvest and rebalance are reviewed in an Offchain Automation Pentest. Liquid staking vaults have their own liquid staking audit.

Get a Vault Audit

Public findings

What Guardian’s vault security audits have found.

Each card links a finding in a public Guardian report. All were resolved.

  1. RH-1Umami GMI · Critical

    A deposit or redemption could carry a callback to the user’s own contract, which ran before the request was cleared. Cancelling the request inside it refunded the deposit while the attacker kept what the request paid out, putting every asset vault’s funds at risk.

    Callbacks Read the finding RH-1 in the Umami GMI Index report

  2. C-07Peapods · Critical

    The lending vault had a public donate function. An attacker could deposit 1 wei, front-run a 100-token deposit with a 100-token donation, and leave the victim with zero shares.

    First deposits Read the finding C-07 in the Peapods Leveraged Volatility Farming report

  3. H-10Peapods · High

    The vault received Fraxlend shares rounded down when it lent and burned them rounded up on repayment, as it should. Repaying the full amount then needed one share more than the vault held, so the repayment reverted.

    Rounding Read the finding H-10 in the Peapods Leveraged Volatility Farming report

  4. C-01BracketFi · Critical

    Burns priced the payout with the wrong formula. After wstETH rose from 1 to 1.1 ETH, burning 10 brktETH paid out 12.1 wstETH against a 10 wstETH deposit.

    Share conversions Read the finding C-01 in the BracketFi Round 1 report

  5. C-01Umami · Critical

    The hedge’s PnL was read with a size change of zero, so it always came back as zero. Margin, and with it the vault’s price per share, ignored every open gain and loss.

    Pending PnL Read the finding C-01 in the Umami GMX V2 Position Manager report

  6. C-01Glider · Critical

    An ERC-4626 wrapper capped exits at Morpho Vault V2’s maxWithdraw, which returns zero by design. Once funds were deployed, every withdrawal and harvest reverted, freezing fully backed deposits.

    Integrations Read the finding C-01 in the Glider Protocol Review report

  7. H-05Glider · High

    Matured deposit requests sat outside the share price and could still be cancelled. A depositor could claim only after a loss, at the impaired price, and take part of the recovery owed to the holders who bore it.

    Async requests Read the finding H-05 in the Glider Protocol Review report

  8. H-04Nunchi · High

    Two vaults on one strategy priced shares from the same total assets but separate share supplies. A 1 WETH deposit into the new vault could withdraw 101 WETH.

    Shared strategies Read the finding H-04 in the Nunchi Protocol Review report

  9. C-01Synthetix LP Vault · Critical

    The reward claim from Synthetix was public. Anyone could trigger it, stranding the rewards in the registry and cutting off the vault’s yield for the cost of gas.

    Harvest Read the finding C-01 in the Synthetix Auto-Compounding LP Vault report

  10. H-02Synthetix SNX Vaults · High

    The performance fee high-water mark reset on every update, even below the old peak. After a drawdown, the vault would charge fees again on gains it had already charged.

    Fees Read the finding H-02 in the Synthetix SNX Vaults report

  11. C-01Gamma · Critical

    A withdrawal could name a USDC-blacklisted recipient. The GMX callback then reverted on the transfer, locking the vault mid-withdrawal so no one could deposit or withdraw.

    Withdrawals Read the finding C-01 in the Gamma GMX V2 Vault report

Onchain · How it runs

Two teams, and share accounting written as code.

  1. 01 / Two teams

    Two independent teams, one scope.

    Team A pairs expert manual review with the fuzzing suite. Team B runs Helix across every corner. Each cross-checks the other.

    • Expert manual review
    • Competitive incentives
    • Cross-checked findings

  2. 02 / Helix AI Auditor

    Helix, the leading AI Auditor.

    Hundreds of parallel agents spend billions of tokens across the entire codebase. Only human-verified findings reach the report.

    • Billions of tokens
    • Human-guided context
    • Human-triaged findings

  3. 03 / Invariant fuzzing

    An invariant suite around your share price.

    Core safety properties become executable invariants, fuzzed across every reachable state. On Umami’s GMI vaults, “TVL of a Vault = PPS * Share Supply” failed under fuzzing.

    • TVL equals price per share times supply
    • Previewed shares equal minted shares
    • Share balances never exceed supply

  4. 04 / Strategies and integrations

    Every protocol the vault plugs into.

    Each adapter is read against how the protocol it calls really behaves: its callbacks, its max and preview functions, and the upgrades its team may ship later.

    • Callbacks and async execution
    • External max and preview functions
    • Reward claims and harvest paths

The suite stays with your code for every later change. Synthetix’s LP vault review logged more than 20 million fuzzing runs, and on Umami’s GMI vaults, fuzzing surfaced a Critical (AV-1) and a High (LCY-1).

Get a Vault Audit

Published work

Yield vaults Guardian has reviewed.

Recent incidents

How vault depositors have lost money.

  1. $10MResupply

    A donation inflated the share price of an empty vault used as collateral. The exchange rate then rounded to zero, so the solvency check passed every borrow, and Resupply took $10 million of bad debt.

    Jun 2025 Our coverage of the Resupply incident

  2. $93MStream Finance

    Stream said an external fund manager lost about $93 million. The loss did not start with a code bug, yet curated vaults that lent against its xUSD took losses.

    Nov 2025 Our breakdown of the Stream Finance collapse

“Having seen many audits over many years, no one even comes close to Guardian’s approach, and the quality of the audit is unmatched.”
KalebSynthetix
“I would recommend Guardian to others looking for a comprehensive audit specifically for complex projects.”
Umami ChanUmami DAO

Resource Hub

Before you book a vault audit.

Questions

Vault audit questions

What does a vault security audit cover?

The vault and its strategy and adapter contracts, at one audited commit. The protocols a strategy calls are not re-audited; the audit checks how your adapters use them. The audit tests the code that accounts for yield, not whether a strategy’s yield will last.

How does an ERC-4626 vault audit test for the inflation attack?

With a fuzzed property that every deposit mints shares. In Peapods’ report, “LendingAssetVault::deposit/mint share balance of receiver should increase” failed. Reviewers then check the two standard fixes: a seed deposit at deployment, or OpenZeppelin’s virtual offset, set high enough that griefing is costly.

Do you audit ERC-7540 asynchronous vaults?

Yes. Glider’s report covers async request vaults. ERC-7540 requires previewDeposit and previewMint to revert on async deposit vaults, so integrators must price requests another way. It also warns that an operator is trusted with both assets and shares, so operator checks are in scope.

Which invariants do you fuzz on a vault?

Accounting identities. The Universal Vault suite ran 24 invariants 5,000,000+ times each, including “Vault’s totalAssets() = convertToAssets(totalSupply())”. Its check that maxDeposit() matches previewMint(maxMint()) failed; the report’s M-01 found maxMint passing assets where shares belong.

Do changes to an audited vault need another audit?

Yes. Bracket’s contract updates review reported 2 Criticals and 8 Highs in changes to its vaults. Adding a share conversion to transfers changed how existing balances were read (H-06) and made the vault convert amounts to shares twice (C-02). Both were resolved.

How long does a vault audit take?

It depends on size and integrations. Published Guardian vault reviews ran 10 days for Synthetix’s Auto-Compound LP Vault, about two weeks for Gamma’s GMX V2 vault, about three weeks for Umami’s GMI vaults, and about three and a half weeks for Peapods’ leveraged volatility farming.

What do we get at the end?

Human-verified findings with proof-of-concept tests, a review of your fixes, and the invariant suite, which stays with your code. On Umami’s GMI vaults, Guardian checked that every remediation resolved its issue without introducing new ones. Synthetix kept a hardened invariant fuzzing suite for continued assurance.

Smart Contract Audit

Other engagements

Start now

Get a quote for your vault audit.

Get a quote