GAIB Pre-Vaults audit

A private security review of Gaib (AI compute financing), conducted with Sherlock and completed on 28th March 2025 over 4 days. 0xSimao disclosed 7 findings: 1 high severity, 2 medium and 4 low.

What Gaib is

GAIB finances AI compute by tokenising GPU-backed yield, and ahead of launching $AID, its AI dollar, it ran a pre-deposit program: ERC-4626 pre-vaults that take deposits early, award points, and put the idle funds to work as a future insurance pool.

Scope

The Sherlock review covered the gaib-ai/pre-vaults repository: deposit and mint flows against the ERC-4626 spec, the sweep mechanism that moves pre-deposit funds into managed wallets, and the interest paths where idle assets sit in venues like Aave.

High severity findings

• User fund loss due to depositing before unearn()

Medium severity findings

• PreDepositVault will not work for USDT
• PreDepositVault does not collect interest for WBTC

Low severity findings

• PreDepositVault::maxDeposit/Mint() are missing maxDepositLimit as per the ERC4626 spec
• ATokens can be swept of the PreDepositVault
• Rounding error in Aave Lending Pool
• PreDepositVault::sweep() uses address.transfer which does not work for certain wallets

The report

Download report (PDF)