VaultCoreLib

All logic lives here; the VaultCore facet is a pure delegator. Storage is accessed via ERC-7201 namespaced slot to avoid collisions in the Diamond proxy.

Must be called inside a pre/postInitializer block, after ERC4626Lib.__ERC4626_init. AccessControl must already be initialized to support the DEFAULT_ADMIN_ROLE check.

Defined as the ERC-20 balance of the underlying asset held by this contract.

Backs the diamond's totalAssets() selector (replacing ERC4626Lib.totalAssets), which ERC4626Lib reads for all share pricing. When a manager is set, adds the manager's totalAllocated() view (which sums each strategy's self-reported balance). Trust assumption: strategy balance reports are accurate. Fails closed: if the manager read reverts or returns malformed data, this reverts with IVaultCore.VaultCoreStrategyNavUnavailable rather than under-reporting the NAV as idle, which would let deposits mint shares cheaply and exits redeem at a discount. allocatedAssets() reverts too.

Latches deposits on the vault when the swap may strand funds (see _setStrategyManager).

Inner logic for setStrategyManager (no auth check — auth in outer). Swapping away from a manager drops its strategies from the NAV and its own deposit latch with it, so funds those strategies return later would move value to whoever deposited after the swap (#305). Unless the previous manager verifiably releases cleanly (_releasesCleanly), the swap sets the vault-side latch and emits IVaultCoreRecovery.ManagerSwapLatchSet. The reads never revert the swap: it is the vault admin's last-resort recovery when the old manager's NAV read is broken. Setting the first manager, or the same manager again, strands nothing and latches nothing.

Inner logic for clearManagerSwapLatch (no auth check).

Empty return data counts as success only when the asset has code (matches OpenZeppelin SafeERC20).

The strategy itself is responsible for pushing assets back to the vault. This function exists to emit the event and allow the StrategyManager to coordinate the accounting.

Reverts with VaultCoreUnauthorizedManager if the caller is not the strategy manager.

During a rebalance the vault's idle balance and the strategies' reported balances are transiently inconsistent, so totalAssets() (and therefore the share price) cannot be trusted. The vault's deposit/mint/withdraw/redeem entry points call this to reject read-only reentrancy via a strategy callback. The manager is an external contract, so we query its reentrancy status by staticcall — mirroring how totalAssets() reads it.

Reads the manager's depositsLatched() (IStrategyManagerRecovery), which a strategy force removal sets (#270). No manager, or a manager whose read fails or returns short data (one without the latch selector), counts as unlatched, mirroring requireManagerNotRebalancing. Any nonzero word counts as latched, so a malformed answer keeps deposits closed rather than reverting the views. A swap away from such a manager is stricter: there a failed read latches (_releasesCleanly).

Called by the deposit/mint entry points. A force removal or a manager swap drops funds from the NAV, so a depositor entering at the lower NAV would capture part of any funds that later return; the latch keeps entries closed until an admin clears it. The error names the latch holder whose clear is due: this vault for the manager-swap latch (checked first), else the strategy manager. Exits are not gated.

True only when manager verifiably strands nothing on a swap: both its depositsLatched() and its totalAllocated() read succeed with a full word, and they report false and 0. Any other answer, including a revert, short return data or running out of gas, returns false, so the swap latches. The old manager cannot then show that its strategies, or the strategies it force-removed, hold nothing. On the last-resort route (a broken NAV read) the old manager still reports allocations or its own sum overflows, so it latches either way. A false latch costs one admin call; a missed one reopens the #270 donation capture.

Staticcalls selector on target and returns the first word of its answer. ok is false when the call reverts or returns fewer than 32 bytes. At most 32 bytes of return data are copied, so an oversized answer cannot exhaust the caller's gas.