Conservation Is an Invariant, Not a Dashboard Metric

A protocol can display plausible TVL while already being insolvent. The audit question is whether every externally callable transition preserves a defined relationship between claims and assets under adversarial token behavior.

State the equation first

For a vault with share liabilities, a minimal solvency invariant is:

realizable_assets + collectible_receivables >= redeemable_shares * share_price + accrued_senior_claims

Each term needs a protocol-specific definition. realizable_assets excludes a token balance that cannot be withdrawn, loses value on transfer, or is valued only by a manipulable spot oracle. A recorded receivable is not an asset unless it is collectible under the same pause, insolvency, and liquidation rules that bind users.

This relation must hold after deposits, withdrawals, mint/burn, fee accrual, harvests, liquidations, migrations, and privileged rescue paths, not only in an end-of-block snapshot.

Nominal input is not custody

Consider a deposit path that calculates shares from an assets argument and then calls transferFrom. A fee-on-transfer or rebasing token may deliver less than requested. If shares are minted from the requested amount, the caller receives a claim on assets never received. Repeating the operation dilutes existing holders; normal redemption turns the accounting bug into a drain.

Measure the custody balance delta around the transfer and mint from the amount actually received. Use that same measured amount for events, caps, fees, and share pricing. A later reconciliation cannot protect holders once the attacker redeems.

Ordering is part of the proof

Correct formulas still fail when an external call exposes an intermediate epoch. Before a withdrawal transfer, reduce the claimant's entitlement, or otherwise ensure a callback cannot price against pre-withdrawal assets with post-withdrawal liabilities. The same question applies to fee minting and share-price updates: a privileged caller must not select whether fees accrue before or after their own deposit or redemption.

A useful review model is:

check authorization and bounds -> update every internal claim -> interact -> verify measured outcome

No reentrant path may observe assets and liabilities from different accounting epochs.

Test the boundary

Fuzz adversarial assets: transfer-fee tokens, no-return tokens, callback tokens, donation-capable tokens, and balances that change independently. Drive sequences of deposits, donations, withdrawals, fee accrual, and pause/unpause while asserting conservation and that no account redeems beyond its defined claim.

Include privileged paths. Emergency withdrawal, strategy migration, and sweep often bypass ordinary checks while moving the largest balances. If one removes an asset still counted in share pricing, it must reduce liabilities atomically, mark the asset unavailable before the transfer, or be unreachable while shares remain redeemable.

The audit artifact should be an equation, its authoritative storage variables, and a transition table for every function that changes either side. Without that map, assets under management is only an observation. With it, conservation is a property the contract must preserve.