# `PreDepositVault::maxDeposit/Mint()` are missing `maxDepositLimit` as per the ERC4626 spec Low/Info · Sherlock · AI compute financing · 28th March, 2025 Finding L-1 of the GAIB Pre-Vaults security review. - Protocol: https://gaib.ai/ - Report: /reports/gaib - Source: https://4221781861-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLXNTW9blcTeiKZrMFhab%2Fuploads%2FQMsETA4dRNo2auiUSeOX%2FAIDa%20Vault%20Audit_20250411.pdf?alt=media&token=5e2f84ea-9698-4fa7-81ef-503771d234aa --- ## Summary `PreDepositVault` has a `maxDepositLimit` which is not reflected in `maxDeposit/Mint`, breaking the ERC4626 spec. ## Vulnerability Detail From the [spec](https://eips.ethereum.org/EIPS/eip-4626#maxdeposit), > MUST factor in both global and user-specific limits ## Impact Non EIP4626 compliance ## Code Snippet https://github.com/sherlock-audit/2025-03-gaib/blob/main/pre-vaults/contracts/pre-vaults/gpdUSDT.sol#L18 ## Tool Used Manual Review ## Recommendation Override `ERC4626::maxDeposit/mint()` and implement the deposit limit there --- Related findings: - [Incorrect `ERC4626ExceededMaxRedeem` event on `ManagedLeveragedVault.sol:: cancelWithdrawalIntent()`](https://0xsimao.com/findings/beraborrow-i-erc4626-exceeded-redeem-withdrawal): Beraborrow Managed Dens - [ERC4626YieldBackend.withdrawMax() silently succeeds when vault is paused, leaving funds stuck](https://0xsimao.com/findings/superfluid-erc4626-yield-paused-stuck): Superfluid Yield Backends - [ERC4626YieldBackend does not support vaults with deposit/withdrawal fees or slashing](https://0xsimao.com/findings/superfluid-erc4626-yield-withdrawal-slashing): Superfluid Yield Backends - [DoSed liquidations as `PrizeVault::liquidatableBalanceOf()` does not take into account the `mintLimit` when the token out is the asset](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-liquidations-prize-liquidatable-mint): PoolTogether Prize Layer