Remanence exists because defects pin a domain wall in
place: what makes a material hold its state is its imperfections. That is the right way round for
a security page, and it is the way round an auditor works.
The share price is a mark, not a counter
Redemption reads the position, including impermanent loss, at the block it is called.
Donations do not reprice
Accounting is on TRACKED balances, so a donation never reaches the share price at all. The virtual-share offset is there too and is the standard defence — but deleting it breaks no property in this vault, which is how we know the tracking is what does the work. That deletion ships as sabotage S0 and correctly catches nothing.
The protocol fee has a ceiling in code
The cap is a constant, the setter reverts above it, and the property suite executes both halves.
The owner cannot reach the principal
Degauss stops the drive. There is no path from any owner-only function to a transfer of deposits, and a sabotaged copy that adds one must fail the suite.
What is not true yet
There is no canonical deployment on any chain, no
token, and nothing here has been through third-party review. The property suite is a floor: it
was written by the same hand as the contract and tests what that hand thought of, which is
exactly the failure third-party review exists to catch. The app defaults to a testnet and can
deploy to a live chain, gated behind an explicit acknowledgement — the risk there is not the
deployer's gas, it is anybody who later deposits believing this has been reviewed.
The threat model
What every part of this site is →