Downcasts that silently truncate, and gaming which branch accrueInterest takes

Mentorship Series #22 · 15 January 2026 · @0xfirefist · Panoptic · Code4rena

We continued the Panoptic contest on Code4rena.

Lesson Summary:

Downcasting truncates the number — watch closely for such casts.
ERC-4626 vaults check the asset amount for zero, not the shares.
Check the cast in the withdraw function — can it cause a problem? Verdict: fine.
Play with numbers across every branch of the accrueInterest function.
Can someone call a function that accrues interest and hit another `owner` through the `!isDeposit` branch, making them burn their shares?
User has enough balance.
User does not have enough balance and it is not a deposit.
User does not have enough balance but it is a deposit: transfer ---> deposit. Search for any way a user could game the accrual of interest.