Round-Trip Invariant

The round-trip invariant is a property used in invariant testing of tokenized vaults: for any user, depositing assets to mint N shares and then immediately redeeming those N shares must never return more than was deposited. Formally, a mint-then-redeem cycle should burn at least as much value as it created — the vault must never be a source of free assets.

Why it matters

A round-trip that returns more than it consumed signals that the vault's rounding or share math favors the depositor somewhere it should favor the vault, which is the fingerprint of value leakage. a16z's erc4626-tests suite applies this check and has caught real mainnet vaults returning a few extra satoshi per round trip — small individually, but exploitable at scale or via flash loans.

Relationship to the inflation attack

The round-trip invariant is one of a short family of ERC-4626 properties (alongside "no zero-share deposits" and "price per share is transfer-invariant") that together catch the inflation attack. Because the property must hold across any call sequence a fuzzer generates — not just a hand-written path — it surfaces the hostile deposit → donate → deposit interleaving that unit tests almost never visit, provided the harness starts from an empty vault and can perform raw donations.