ERC-4626 virtual-share offset (OZ ≥4.9)
A economic risk factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor evaluates whether ERC-4626 vaults in the protocol use OpenZeppelin version 4.9 or later, which introduced virtual shares and virtual assets to prevent first-depositor share inflation attacks. The check is performed via source inspection against the deployed bytecode. For non-ERC-4626 protocols, this factor is N/A. For ERC-4626 vaults using OZ below version 4.9, the factor triggers a review of whether an alternative inflation mitigation (such as a dead-shares burn on deployment) is present.
Why it matters
The ERC-4626 first-depositor inflation attack is a variant of the empty-cToken problem (RD-F-070) applied to yield-bearing vaults. When a vault has zero total supply, an attacker can donate assets directly to the vault contract before the first legitimate depositor, inflating the share price and causing the legitimate depositor's shares to be worth near-zero. OpenZeppelin 4.9 introduced virtual shares (a small constant added to both total supply and total assets) to make this attack economically non-viable. The bEarn exploit ($18M, 2021) demonstrated a related cross-token accounting vulnerability in a multi-layer vault architecture, illustrating the broader class of first-depositor attacks on vault share accounting.
Green / Yellow / Red
Green: all ERC-4626 vaults use OZ version 4.9 or later, or implement an equivalent virtual-share offset that prevents inflation attacks. Yellow: some vaults use earlier OZ versions but implement a dead-shares burn or equivalent mitigation; or all vaults use earlier versions with curator-verified compensating controls. Red: one or more live ERC-4626 vaults use OZ below version 4.9 with no virtual-share offset or dead-shares mitigation.
Common gray cases
Non-standard ERC-4626 implementations that do not use OpenZeppelin may have equivalent protections implemented differently; curator must verify the economic properties of the share accounting rather than the specific library version.
Notable historical examples
- bEarnFi ($18M, 2021): Multi-layer vault with cross-token accounting vulnerability; related share-inflation class.
Measurement what to look for#
Determine whether ERC-4626 vaults use OpenZeppelin ≥4.9 virtual-share offset pattern to prevent first-depositor share-inflation.