Plimsoll
ERC-4626 has nowhere in its signatures to say what you will accept, so a conforming vault has to expose a door with no limit on it. When the vault prices a position rather than a pile, the number behind that door is one anybody can move in the same block as your deposit. Plimsoll publishes the line, computes it from the water the vault is actually floating in, and shows you the loss on the market you are standing in front of.
The door with no line on it, priced
Executed on Robinhood Chain at block 57,180,442
- A LULU vault, 80% of it a marked position
- $99,999
- You deposit
- $10,000
- Somebody moves the same pool, in the same block
- $30,000
- Shares you were quoted, against shares you got
- −$31.72
The problem
A number you were shown, not a number you are owed
Every vault interface tells you how many shares your deposit will buy. The standard it is built on has nowhere to put that promise.
What the signature allows
deposit(assets, receiver)returns however many shares it returns. There is no minimum anywhere in the call.redeem(shares, receiver, owner)is the same shape going the other way.- The standard's own preview functions are documented as estimates that may differ from what executes.
- There is no deadline either, so a transaction can sit in a queue and land in a different world.
Why that stops being harmless
- It is harmless while
totalAssets()is a balance. Nobody can move a balance. - It is a mark in every vault that holds a position rather than a pile — which is every vault that earns anything.
- A mark is a pool price, and a pool price is a number anybody can move in the same block as your deposit.
- Nothing reverts. You are issued fewer shares than the page said, and the page is gone.
Executed, not argued
One block on Robinhood Chain
A real vault, a real LULU pool, a real swap, a real deposit —
inside a single eth_call against live chain state. No testnet, no fork, no mock pool, no private key.
The depositor lost money on every one of the 9 markets this was run against, from $1.16 on SGOV to $10,995 on ASML.
What the measurement changed
You do not need an attacker
This site was built expecting to show that any vault of this shape can be sandwiched for money. On most of these markets it cannot: the round trip through the pool costs the attacker more than the deposit gives up.
Profitable for a searcher
3 of 9On the rest, an attacker committing 3× the deposit ends the block down — $148.14 on LULU. Nobody would do it deliberately.
Costly to the depositor
9 of 9The loss does not depend on anybody profiting. Somebody trading that pool for ordinary reasons in your block does exactly the same thing to your deposit, and pays nothing extra to do it.
That is the useful version of the claim, and it is the one this contract is built around. The loss is not an exotic attack you can hope to avoid; it is what a quote means when the quote is a mark.
The answer
A line, and a ladder of lines
A ship does not carry one load line. It carries six, because how deep a hull may sit depends on the water it is floating in. A tolerance somebody typed is one line for every sea.
The doors that carry a line
depositWith(assets, receiver, minShares, deadline) and its twin on the way out.
Below the floor the transaction reverts and you keep your money.
- The plain ERC‑4626 doors stay open and unguarded, because the standard requires them.
- The site says which door is which rather than hoping you never use the other one.
The floor the contract computes
loadLine(assets) reads the pool's own liquidity at the current tick and discounts the
quote by what an attacker committing the same capital could do to the share price.
- Self‑scaling: tight in a deep pool, wide in a thin one, with nothing to configure.
- Measured: it refuses from exactly ×1 the assumed size upward, and not below.
The exit that reads no price
abandon(shares, receiver) burns your shares for a pro‑rata slice of everything the
vault holds — cash and position — and never touches the mark at all.
- It cannot be sandwiched, because there is no number to move.
- It is the honest answer to "what is my share worth", and it hands you a token you did not ask for.
The ladder, measured
The same $10,000 deposit, 403 times the exposure
Read live from 82 tokenised‑equity markets on Robinhood Chain. One number is not a tolerance for all of them.
Seven rungs, taken at fixed quantiles
How far $10,000 moves the mark, in basis points, computed from each pool's liquidity at block 57,180,442. Bars are on a log scale. Recompute any of them in your browser →
What is checked
Run on the chain, then deliberately broken
Every property is executed on Robinhood Chain's own EVM through
eth_call. Then the contract is compiled again with one defect at a time and each one has to be
caught.
Deploy one from your own wallet
Pick a market, deploy, and drive both doors against real USDG. Every write is simulated from your address before you sign. This repository holds no key and no vault is canonical.