Vault accounting refers to internal balance tracking within a protocol's main contract (vault), where the protocol maintains its own ledger of user balances separate from actual ERC-20 token balances. This pattern enables gas-efficient operations and complex multi-step transactions but introduces unique security considerations.

How Vault Accounting Works

1Traditional:
2User → ERC-20 transfer → Protocol → ERC-20 transfer → User
3(2 external calls per operation)
4
5Vault Accounting:
6User deposits once → Internal balance updates → User withdraws once
7(Only 2 external calls total for many operations)

Key Components

Internal Balances: The vault maintains mapping(address => mapping(IERC20 => uint256)) tracking what each user "owns" within the vault.

Delta Tracking: During multi-step operations, the vault tracks balance changes (deltas) and settles only at the end.

Settlement: Final step where internal accounting reconciles with actual token transfers.

Security Implications

Benefits

• Reduced gas costs
• Atomic multi-operation transactions
• Flash loan/swap capabilities

Risks

• Accounting errors can drain funds
• Reentrancy through callbacks during settlement
• Oracle manipulation between accounting and settlement
• Rounding errors compounding across internal operations

Balancer V2 Example

Balancer's Vault uses internal balances extensively:

1// User deposits tokens, vault updates internal balance
2function deposit(IERC20 token, uint256 amount) external {
3    token.transferFrom(msg.sender, address(this), amount);
4    _increaseInternalBalance(msg.sender, token, amount);
5}
6
7// Swaps update internal balances without transfers
8function swap(...) external {
9    _decreaseInternalBalance(sender, tokenIn, amountIn);
10    _increaseInternalBalance(sender, tokenOut, amountOut);
11}

Common Vulnerabilities

Balance inconsistency: When internal accounting doesn't match actual token balances (as seen in Balancer's $128M vulnerability).

Reentrancy: Callbacks during partial settlement can exploit intermediate states.

Precision loss: Rounding in internal calculations can be extracted over many operations.

Vault accounting is powerful for gas optimization but demands rigorous invariant testing to ensure internal and external balances remain synchronized.