Security Considerations

Settlement Layer Security Priorities

Critical Invariants:

1. Zero-Sum Settlements: Batch transfers neither create nor destroy value
2. Liquidity Protection: Reserved settlement funds cannot be invested
3. Withdrawal Safety: The permit system blocks unauthorized exits
4. Atomic Settlements: All transfers in a batch succeed together or all revert

Attack Vectors to Consider:

• Manipulating batch netting calculations to extract value
• Withdrawing mid-settlement to force a failure
• Double-spending settlement obligations
• Injecting false rBalance adjustments to fabricate profits

Investment Layer Security Priorities

Critical Invariants:

1. Reserved Asset Protection: Pending and claimable funds stay off-limits for investment
2. Share Accounting: duPRT is backed by vault assets and settlement positions at all times
3. Fulfillment Accuracy: Pending-to-claimable conversions must be exact
4. Investment Safety: The contract cannot invest beyond the available balance

Attack Vectors to Consider:

• Inflating the reserved-asset calculation to justify over-investment
• Exploiting the async flow to claim assets twice
• Front-running fulfillment transactions
• Corrupting storage slots during contract upgrades