# GAIB Pre-Vaults audit Sherlock · AI compute financing · 28th March 2025 A private security review of Gaib (AI compute financing), conducted with Sherlock and completed on 28th March 2025 over 4 days. 0xSimao disclosed 7 findings: 1 high severity, 2 medium and 4 low. ## What Gaib is GAIB finances AI compute by tokenising GPU-backed yield, and ahead of launching $AID, its AI dollar, it ran a pre-deposit program: ERC-4626 pre-vaults that take deposits early, award points, and put the idle funds to work as a future insurance pool. ## Scope The Sherlock review covered the gaib-ai/pre-vaults repository: deposit and mint flows against the ERC-4626 spec, the sweep mechanism that moves pre-deposit funds into managed wallets, and the interest paths where idle assets sit in venues like Aave. ## High severity findings - [User fund loss due to depositing before `unearn()`](https://0xsimao.com/findings/gaib-fund-loss-depositing-unearn) ## Medium severity findings - [`PreDepositVault` will not work for USDT](https://0xsimao.com/findings/gaib-pre-deposit-work-usdt) - [`PreDepositVault` does not collect interest for `WBTC`](https://0xsimao.com/findings/gaib-pre-deposit-interest-wbtc) ## Low severity findings - [`PreDepositVault::maxDeposit/Mint()` are missing `maxDepositLimit` as per the ERC4626 spec](https://0xsimao.com/findings/gaib-deposit-mint-erc4626-spec) - [ATokens can be swept of the `PreDepositVault`](https://0xsimao.com/findings/gaib-tokens-swept-pre-deposit) - [Rounding error in Aave Lending Pool](https://0xsimao.com/findings/gaib-rounding-error-aave-lending) - [`PreDepositVault::sweep()` uses `address.transfer` which does not work for certain wallets](https://0xsimao.com/findings/gaib-deposit-sweep-transfer-wallets) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-03-28-gaib.pdf)