`PreDepositVault::maxDeposit/Mint()` are missing `maxDepositLimit` as per the ERC4626 spec

Low/InfoGAIB Pre-Vaults audit·Sherlock·AI compute financing·28th March, 2025·by 0xSimaoL-1

Summary

PreDepositVault has a maxDepositLimit which is not reflected in maxDeposit/Mint, breaking the ERC4626 spec.

Vulnerability Detail

From the spec,

MUST factor in both global and user-specific limits

Impact

Non EIP4626 compliance

Code Snippet

Tool Used

Manual Review

Recommendation

Override ERC4626::maxDeposit/mint() and implement the deposit limit there

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests

PreDepositVault::maxDeposit/Mint() are missing maxDepositLimit as per the ERC4626 spec