Attack vectors
This page is a non-exhaustive threat-review framework, not a security certification or complete launch checklist. For each dependency, document the failure mode, tests, monitoring, mitigations, and incident response for the exact deployment.
Oracle manipulation and stale prices
A manipulated, stale, unavailable, incorrectly scaled, or misrouted oracle can distort borrowing power and liquidation. Test route precedence, decimals, update cadence, stale-data behavior, bounds, fallbacks, and governance changes. Monitor every dependency in the configured quote path.
ERC-4626 conversion and donation attacks
Share-price conversion can be manipulated or economically unrealizable. convertToAssets can omit redemption liquidity, fees, slippage, gates, and user restrictions. Test donation/inflation scenarios, rounding at small supply, nested-vault recursion, and stressed redemption before using share conversion in solvency pricing.
See Donation attacks and Oracle router configuration.
Malicious assets, hooks, and callbacks
Tokens can have transfer fees, rebases, callbacks, nonstandard return values, blacklists, freezes, or upgradeable behavior. Hooks can revert operations, call external systems, or introduce new state and availability dependencies. Test deposits, withdrawals, borrows, repayments, transfers, liquidations, and EVC batches against each relevant behavior.
Governance and role compromise
A compromised or misconfigured governor, guardian, operator, allocator, or oracle-router role can change only its authorized settings, but those settings may materially affect users. Inventory permissions, timelocks, emergency bypasses, ownership, upgrade paths, and signer security. Monitor role and parameter changes from deployed state.
Caps, LTVs, IRMs, and liquidation settings
Incorrect units or assumptions can create excessive borrowing power, extreme rates, unavailable liquidity, or ineffective liquidation. Simulate boundary utilization, oracle moves, cap exhaustion, LTV ramps, rate extremes, cool-off periods, and maximum liquidation discounts. Verify raw contract units rather than copying UI display values.
Liquidity and liquidation failure
A position can be liquidatable while collateral cannot be sold, transferred, or redeemed, or while the liability vault lacks necessary liquidity. Test liquidator eligibility, swap depth, slippage, oracle-update requirements, restricted tokens, and stressed withdrawals. Monitor account health, usable liquidity, liquidation participation, and failed transactions separately.
Correlation, recursion, and bad debt
Correlated collateral and liability assets can fail together. Nested vaults and cross-collateral relationships add recursive dependencies, while shared liability or collateral vaults can transmit stress beyond an apparently isolated pair. Model common-dependency failures and document the vault's configured bad-debt handling.
Review output
Record the exact contracts, versions, chain, parameters, role addresses, assumptions, tests, monitors, alerts, and response owner. Re-run the review when any dependency or configuration changes.