Prototype Content
Share Inflation And Proportional-accounting Failure
A vault or pool mints ownership units using an accounting denominator that no longer reflects the current asset state.
Preconditions
- Share minting depends on mutable accounting state
- A second path can update assets or fees
- The denominator can become stale
Detection heuristics
- Compare asset refresh order with share mint order
- Look for cached totals across external or fee paths
- Test deposits after accounting side effects
Mitigation
- Refresh accounting before minting shares
- Use preview and execution paths with the same denominator
- Add invariant tests around share price conservation
Invariant shape
minted shares must remain proportional to current assets and existing supply.
A protocol uses a price observation period that can be dominated by short-lived market movement or synthetic liquidity shifts.
Preconditions
- Collateral or settlement depends on oracle output
- Observation window is short or thin
- Market depth assumptions are weak
Detection heuristics
- Inspect window length and update cadence
- Model low-liquidity price movement
- Check whether one observation can dominate risk decisions
Mitigation
- Lengthen or diversify observation windows
- Add circuit breakers
- Validate liquidity and freshness before using prices
Invariant shape
risk decisions should use an observation window that resists short-lived manipulation.
A cross-domain receiver validates payload shape but not the complete binding between sender, origin domain, destination domain, and intent.
Preconditions
- Message receiver executes privileged actions
- Domain metadata is available
- Validation focuses on payload structure
Detection heuristics
- Trace every trusted field in the message envelope
- Check sender and origin-domain binding
- Review replay and destination-domain protections
Mitigation
- Bind sender, source domain, destination domain, nonce, and payload hash
- Reject unexpected counterpart domains
- Add explicit bridge-message invariant tests
Invariant shape
privileged messages must be bound to the expected counterpart and domain before execution.
A sensitive action can be authorized after credential compromise because operational controls do not contain signer authority.
Preconditions
- Signer controls privileged operation
- Monitoring or approval threshold is weak
- Revocation path is slow or unclear
Detection heuristics
- Map privileged signer powers
- Check approval thresholds
- Review monitoring and emergency revocation paths
Mitigation
- Use threshold approval
- Limit signer permissions
- Add monitoring, rotation, and emergency pause procedures
Invariant shape
one compromised credential should not be enough to move sensitive system state.