Security Notes

This section documents the architectural security measures implemented within King's Vault V2.

Area	Note
Upgradeability	The Controller and HyperCoreAllocator utilize the UUPS upgradeable pattern and manage internal layout via ERC-7201 namespaced storage, preventing storage collision risks during future upgrades.
Reentrancy	All outward-facing capital movements, including Vault withdrawal, async claim, and emergency redemption paths, enforce strict nonReentrant modifiers to protect against reentrancy attacks.
Emergency Design	The shutdown() function acts as a permanent kill switch for the vault. Once triggered, normal deposit/withdraw flows are permanently disabled, switching the vault to an emergency redemption-only mode.
Strategy Failure Isolation	The liquidity waterfall mechanism catches failed replenish() calls to external strategies and smoothly retries with the remaining active strategies, ensuring one broken strategy does not freeze entire vault withdrawals.
Cross-chain State	To prevent spoofing, HyperStrategy only processes state updates matching the expected CCTP source domain and the registered HyperCoreAllocator sender.
Fee Minting	Performance fee shares dilute existing vault holders and are deliberately designed to only be minted after an Admin explicitly confirms a profitable NAV epoch, preventing automated exploits or Keeper manipulation.
Harvest Protection	The native vault asset and vault share tokens are strictly protected from harvest sweeps while the vault is active, and remain locked for 7 days post-shutdown to ensure fair distribution before dust sweeping is permitted.