ERC-4626 Vault Test Reveals How Attackers Can Wipe Out Depositor Shares

ERC-4626 is a standard that gives tokenized vaults a shared interface for deposits, withdrawals, and share accounting, where users receive shares proportional to their contribution. A developer exploring vault behavior built a Foundry test suite, originally intended as a hardened base contract, to examine edge cases in exchange-rate fairness. One local test demonstrated a known attack vector: an attacker deposited one base unit of an 18-decimal token, then donated 10,000 tokens directly to the vault, causing the next depositor's 50-token deposit to yield zero shares. The test showed the attack is costly for the attacker too, who lost roughly 4,975 tokens due to OpenZeppelin's virtual asset accounting preventing full recovery of the donation. The project highlights that vault behaviors like donation accounting and post-redemption asset handling depend heavily on implementation choices, making a single universal protective base contract insufficient.