Staking and vault audits
Staking contracts and ERC-4626 vaults fail in their accounting. A HYDN audit checks share and reward maths, rounding direction, first depositor and donation attacks, withdrawal queues, strategy and slashing risk, and every path where assets enter or leave, so that no depositor can take value from another.
What we check
- Share accounting. Conversions between assets and shares in both directions, and that rounding always favours the vault over the caller.
- First depositor and donation attacks. Whether an empty or near-empty vault can be manipulated through direct transfers. See ERC-4626 inflation attacks.
- Reward distribution. Reward per share maths, accrual timing, and whether someone can stake just before a distribution and leave just after.
- Withdrawals. Queues, cooldowns and partial withdrawals, and whether a withdrawal can be blocked or front-run.
- Strategies. What the vault does with deposits, what happens when a strategy loses money, and who can change the strategy.
- Slashing and penalties. That losses are spread as designed, and cannot be pushed onto a subset of users.
- Integrations. How the vault’s share price is read by other protocols, since a manipulable share price is a manipulable oracle.
Why vaults deserve their own audit focus
Vault code often looks simple because the standard defines the interface. The risk is in the numbers behind it. Small rounding errors repeated in a loop, a share price read during a callback, or a donation made at the right moment can all move real value between depositors without any line of code being obviously wrong.
Frequently asked questions
What is an ERC-4626 inflation attack?
An attacker deposits a tiny amount into an empty vault, then donates assets directly to it so that each share is worth a great deal. The next depositor's shares round down, sometimes to zero, and the attacker redeems the difference. See our explainer on the attack for mitigations.
Do you audit restaking protocols?
Yes. Restaking adds slashing conditions and dependencies on other protocols, which we trace through the accounting.
Published Updated