Pinning
A perfect crystal holds nothing.
Remanence exists because defects pin the domain walls in place, so what makes a material keep its state is its imperfections. That is the right way round for a security page, and it is the way round an auditor works.
PINNING SITES
The share price is a mark, not a counter
Why it matters. A vault whose share price only ever rises is one whose accounting has stopped being a measurement. Total assets over total supply has to be able to go down.
What holds it. Redemption reads the position, including impermanent loss, at the block it is called.
Donations do not reprice
Why it matters. Sending assets to a vault directly must not move the share price, or the first depositor can be front-run into rounding.
What holds it. Accounting is on TRACKED balances, so a donation never reaches the share price at all. The virtual-share offset is there too and is the standard defence — but deleting it breaks no property in this vault, which is how we know the tracking is what does the work. That deletion ships as sabotage S0 and correctly catches nothing.
The protocol fee has a ceiling in code
Why it matters. A fee an owner can raise without limit is a fee that will be raised.
What holds it. The cap is a constant, the setter reverts above it, and the property suite executes both halves.
The owner cannot reach the principal
Why it matters. An emergency function that can move assets is a key wearing a hard hat.
What holds it. Degauss stops the drive. There is no path from any owner-only function to a transfer of deposits, and a sabotaged copy that adds one must fail the suite.
Nothing here has been audited
Why it matters. A property suite is written by the same person as the contract and tests what they thought of.
What holds it. It does not hold. This is stated on every page that describes the contract, and four deliberately broken copies are run on every build to show the suite is at least awake — which is a floor, not a substitute.
DEGAUSS
The stop that cannot move anything.
Degaussing walks the field down to zero and leaves the material where it is. It ends the drive; it does not take the metal — property P11 executes exactly that: after Degauss, deposits revert and redemptions do not.
That no owner-only function can reach the principal is a separate claim and a
harder one. P10 calls every owner function in turn and requires the depositor to still
redeem in full; P15 then requires the contract’s external surface to be exactly the
25 functions written down, because P10 can only call functions somebody
remembered to list. Sabotage S4 adds an owner-only rescue() that moves
deposits, and it walks straight past P10 — P15 is what catches it. That one is a build-time
check, so the runner on /yoke reports it as such rather than pretending
an EVM ran it.
This is a floor, and it is not an audit.
The suite was written by the same hand as the contract and tests what that hand thought of. Nothing in this repository has been through third-party review, and there is no canonical deployment on any chain. The app defaults to a testnet; a live chain is a deliberate choice behind an acknowledgement, and deploying one does not make it audited.