A vault is simply explained a yield-bearing smart contract designed to maximize the returns on assets deposited by users. When you deposit an asset into a vault, you receive a deposit receipt that represents your share of the vault. This receipt is dynamic as it increases in value as the vault's assets grow, mirroring the performance of the underlying investments. A prominent example of such a mechanism is @OpenZeppelin 's ERC-4626 standard, which has become the benchmark for vault implementations. Most vaults have corresponding strategy contracts which enable the vault to actually achieve a return on investment.
Strategy Contracts:
How to put assets to work: A strategy contract is essentially the brain of the vault, which determines how the deposited assets are to be invested to generate yield. These contracts can be either integrated within the vault itself or exist as separate entities that interact with the vault. The primary functions of a strategy contract includes depositing assets into liquidity pools, lending protocols, or yield farms, managing withdrawals, and executing harvest operations to realize gains. The versatility of strategy contracts allows a single vault to diversify its investment across multiple protocols, spreading risk and enhancing potential returns. There are two types of strategies: Governance Managed Strategies or Automated Strategies.The latter is often used for a single vault <-> strategy connection where an automated deposit into one protocol happens. The first is used for multiple strategies, where specifically governance can manually set the different allocation.
The Paramount Rule of Vault Operations: A critical aspect of vault management is the accurate tracking of the USD value of deposited assets at every state transition. This ensures that users are issued shares that precisely reflect their contribution to the vault, based on the current value of the underlying assets. Some sophisticated vault implementations adopt linear vesting mechanisms for gains, adding another layer of complexity to share valuation. Often vaults lack this correct mechanism and can get exploited via a flash-theft which is nothing else than exploiting the un-updated state of the vault during a deposit, then update the state and withdraw. This will allow an attacker to flash-theft the vault value appreciation. Or obviously general price/share manipulation tricks.
Vaults for Concentrated Liquidity Protocols: I have audited quite a few vaults for concentrated liquidity protocols and these are probably the more complex protocols, which introduce unique risks. These vaults are particularly vulnerable due to the complexity of the underlying protocols and the common lack of familiarity among developers and auditors with these systems. Common vulnerabilities are flawed share calculations for the vault itself as well as manipulation possibilities of the state from the underlying concentrated liquidity protocol in order to steal the vault's reserves, remember, the vault is a liquidity provider and you can manipulate the pool with a simple swap, so you can trigger the vault to add liquidity to a very un-beneficial price-range, if no safeguards are in place. One of the most beautiful implementations i have audited is the following: https://paladinsec.co/projects/trader-joe/…
Audit Report - Trader Joe (v2 Vaults)" for @TraderJoe_xyz and written by @Louis_Mslf
in my opinion one of the best solidity developers on this planet.
Strategy Contracts:
How to put assets to work: A strategy contract is essentially the brain of the vault, which determines how the deposited assets are to be invested to generate yield. These contracts can be either integrated within the vault itself or exist as separate entities that interact with the vault. The primary functions of a strategy contract includes depositing assets into liquidity pools, lending protocols, or yield farms, managing withdrawals, and executing harvest operations to realize gains. The versatility of strategy contracts allows a single vault to diversify its investment across multiple protocols, spreading risk and enhancing potential returns. There are two types of strategies: Governance Managed Strategies or Automated Strategies.The latter is often used for a single vault <-> strategy connection where an automated deposit into one protocol happens. The first is used for multiple strategies, where specifically governance can manually set the different allocation.
The Paramount Rule of Vault Operations: A critical aspect of vault management is the accurate tracking of the USD value of deposited assets at every state transition. This ensures that users are issued shares that precisely reflect their contribution to the vault, based on the current value of the underlying assets. Some sophisticated vault implementations adopt linear vesting mechanisms for gains, adding another layer of complexity to share valuation. Often vaults lack this correct mechanism and can get exploited via a flash-theft which is nothing else than exploiting the un-updated state of the vault during a deposit, then update the state and withdraw. This will allow an attacker to flash-theft the vault value appreciation. Or obviously general price/share manipulation tricks.
Vaults for Concentrated Liquidity Protocols: I have audited quite a few vaults for concentrated liquidity protocols and these are probably the more complex protocols, which introduce unique risks. These vaults are particularly vulnerable due to the complexity of the underlying protocols and the common lack of familiarity among developers and auditors with these systems. Common vulnerabilities are flawed share calculations for the vault itself as well as manipulation possibilities of the state from the underlying concentrated liquidity protocol in order to steal the vault's reserves, remember, the vault is a liquidity provider and you can manipulate the pool with a simple swap, so you can trigger the vault to add liquidity to a very un-beneficial price-range, if no safeguards are in place. One of the most beautiful implementations i have audited is the following: https://paladinsec.co/projects/trader-joe/…
Audit Report - Trader Joe (v2 Vaults)" for @TraderJoe_xyz and written by @Louis_Mslf
in my opinion one of the best solidity developers on this planet.
