Feat/260

contracts/vault/src/fuzz_math.rs

@@ -183,25 +183,64 @@ proptest! {
 
 proptest! {
     /// Deposit then full-withdraw: user never receives more than deposited.
+    /// Uses the full i128 range to ensure no panics occur on extreme values.
     #[test]
     fn fuzz_deposit_withdraw_no_profit(
-        deposit_amount in 1i128..=1_000_000_000i128,
+        deposit_amount in 1i128..=i128::MAX,
     ) {
         let (env, client, admin, token_addr) = setup();
         let user = Address::generate(&env);
 
         mint(&env, &token_addr, &admin, &user, deposit_amount);
 
-        let shares = client.deposit(&user, &deposit_amount);
-        prop_assert!(shares > 0, "deposit minted zero shares");
+        let deposit_result = client.try_deposit(&user, &deposit_amount);
+
+        if let Ok(Ok(shares)) = deposit_result {
+            prop_assert!(shares > 0, "deposit minted zero shares");
 
-        let returned = client.withdraw(&user, &shares);
-        prop_assert!(
-            returned <= deposit_amount,
-            "withdraw returned more than deposited: {} > {}",
-            returned,
-            deposit_amount
-        );
+            let returned_result = client.try_withdraw(&user, &shares);
+            if let Ok(Ok(returned)) = returned_result {
+                prop_assert!(
+                    returned <= deposit_amount,
+                    "withdraw returned more than deposited: {} > {}",
+                    returned,
+                    deposit_amount
+                );
+            }
+        }
+    }
+
+    /// Test that tiny deposits (like 1 stroop) correctly fail instead of silently
+    /// losing funds if they would round down to 0 shares due to yield accrual.
+    #[test]
+    fn fuzz_tiny_deposit_with_yield(
+        deposit_amount in 1i128..=10i128,
+        yield_amount in 100i128..=1_000_000i128,
+    ) {
+        let (env, client, admin, token_addr) = setup();
+        let user_1 = Address::generate(&env);
+        let user_tiny = Address::generate(&env);
+
+        let initial_deposit = 100i128;
+        mint(&env, &token_addr, &admin, &user_1, initial_deposit);
+        client.deposit(&user_1, &initial_deposit);
+
+        mint(&env, &token_addr, &admin, &admin, yield_amount);
+        client.distribute_yield(&yield_amount);
+
+        mint(&env, &token_addr, &admin, &user_tiny, deposit_amount);
+
+        let deposit_result = client.try_deposit(&user_tiny, &deposit_amount);
+        let projected_shares = client.calculate_shares(&deposit_amount);
+
+        if projected_shares == 0 {
+            prop_assert!(
+                deposit_result.is_err(),
+                "deposit should revert if shares round to 0 to prevent silent loss"
+            );
+        } else {
+            prop_assert!(deposit_result.is_ok(), "deposit should succeed if shares > 0");
+        }
     }
 
     /// calculate_shares then calculate_assets round-trip via contract calls.

contracts/vault/src/lib.rs

@@ -722,6 +722,8 @@ impl YieldVault {
     }
 
     /// Calculates the number of shares given an asset amount based on the current exchange rate.
+    /// Uses integer division which naturally floors the result. This rounds down the number
+    /// of shares issued, which is consistently in favour of the vault.
     pub fn calculate_shares(env: Env, assets: i128) -> Result<i128, VaultError> {
         let ts = Self::total_shares(env.clone());
         let ta = Self::total_assets(env.clone());
@@ -733,6 +735,8 @@ impl YieldVault {
     }
 
     /// Calculates the underlying asset value given an amount of shares.
+    /// Uses integer division which naturally floors the result. This rounds down the number
+    /// of assets returned, which is consistently in favour of the vault.
     pub fn calculate_assets(env: Env, shares: i128) -> Result<i128, VaultError> {
         let ts = Self::total_shares(env.clone());
         let ta = Self::total_assets(env.clone());
@@ -799,6 +803,11 @@ impl YieldVault {
 
         let shares_to_mint = Self::calculate_shares(env.clone(), amount)?;
 
+        // Prevent users from silently losing funds due to rounding on tiny deposits
+        if shares_to_mint == 0 {
+            return Err(VaultError::InvalidAmount);
+        }
+
         // Transfer assets from user to vault
         token_client.transfer(&user, &env.current_contract_address(), &amount);
 
@@ -855,6 +864,11 @@ impl YieldVault {
 
         let assets_to_return = Self::calculate_assets(env.clone(), shares)?;
 
+        // Prevent users from silently losing shares due to rounding on tiny withdrawals
+        if assets_to_return == 0 {
+            return Err(VaultError::InvalidAmount);
+        }
+
         let token_addr = Self::token(env.clone());
         let token_client = token::Client::new(&env, &token_addr);
         let vault_address = env.current_contract_address();

contracts/vault/src/test.rs

@@ -858,3 +858,82 @@ fn test_upgrade_contract() {
     // Version should increment
     assert_eq!(vault.version(), 2);
 }
+
+// ─── Invariant Tests (Issue #258) ───────────────────────────────────────────────
+
+#[test]
+fn test_invariant_pool_conservation_and_monotonic_price() {
+    let env = Env::default();
+    env.mock_all_auths();
+
+    let (vault, _, usdc_sa, admin) = setup_vault(&env);
+
+    let user1 = Address::generate(&env);
+    let user2 = Address::generate(&env);
+    let user3 = Address::generate(&env);
+
+    usdc_sa.mint(&user1, &1_000_000_000);
+    usdc_sa.mint(&user2, &1_000_000_000);
+    usdc_sa.mint(&user3, &1_000_000_000);
+    usdc_sa.mint(&admin, &500_000_000);
+
+    let assert_pool_conservation = |v: &YieldVaultClient| {
+        let shares = v.total_shares();
+        let assets = v.total_assets();
+        let price = v.get_share_price();
+
+        if shares == 0 {
+            assert_eq!(assets, 0);
+        } else {
+            let reconstructed_assets = (shares.checked_mul(price).unwrap()) / SCALE;
+            let diff = (assets - reconstructed_assets).abs();
+            assert!(diff <= 1, "Pool conservation invariant failed. Expected: {}, Got: {}", assets, reconstructed_assets);
+        }
+    };
+
+    // 1. Zero deposits edge case
+    assert_pool_conservation(&vault);
+    let mut last_price = vault.get_share_price();
+    assert_eq!(last_price, SCALE);
+
+    // 2. Initial deposits
+    vault.deposit(&user1, &100_000);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+    last_price = vault.get_share_price();
+
+    vault.deposit(&user2, &200_000);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+    last_price = vault.get_share_price();
+
+    // 3. Yield Accrual (Monotonically non-decreasing price)
+    vault.accrue_yield(&50_000);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+    last_price = vault.get_share_price();
+
+    // 4. Partial withdrawal
+    vault.withdraw(&user1, &50_000);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+    last_price = vault.get_share_price();
+
+    // 5. Another yield accrual
+    vault.accrue_yield(&20_000);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+    last_price = vault.get_share_price();
+
+    // 6. Max deposit cap / large deposit
+    vault.deposit(&user3, &500_000_000);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+    last_price = vault.get_share_price();
+
+    // 7. Full withdrawals
+    let user2_balance = vault.balance(&user2);
+    vault.withdraw(&user2, &user2_balance);
+    assert_pool_conservation(&vault);
+    assert!(vault.get_share_price() >= last_price, "Price decreased");
+}