Background
UpdateVaultAUMFeeBips (keeper/vault.go:550-570) reconciles outstanding fees before applying a new rate, so that time accrued under the old rate is settled at the old rate. That is the documented contract of the method.
That contract breaks for paused vaults: reconcileVault (keeper/reconcile.go:46-48) returns nil immediately when vault.Paused, so the "reconcile before bips change" step silently does nothing, and the rate change proceeds anyway. UnpauseVault (keeper/msg_server.go:575) does not settle fees or reset FeePeriodStart either.
Problem
PauseVault reconciles before pausing, leaving FeePeriodStart at pause time. If the fee rate is changed while the vault is paused, the next fee reconcile after unpause applies the new rate over the entire elapsed period since FeePeriodStart, including time that elapsed under the old rate. A rate increase retroactively overcharges depositors; a rate decrease undercharges the vault operator.
This also leaves an undocumented policy gap: whether AUM fees should accrue during a pause at all is currently an accident of where FeePeriodStart was frozen, not a decision.
Proposed changes
The following are proposals. One (or a combination) will be selected at implementation time.
- Proposal A: Reject bips changes while paused. Return an error from
UpdateVaultAUMFeeBips when vault.Paused, requiring unpause first. Smallest change, preserves the settle-before-change invariant by construction, but constrains operators.
- Proposal B: Checkpoint before the change. When paused, compute the fee accrued at the old rate up to the current block, fold it into
OutstandingAumFee, and reset FeePeriodStart before applying the new bips. Keeps the operation available without retroactive repricing, but adds a settlement path that runs against paused vaults.
- Proposal C: Reset the fee period on pause/unpause. Have
UnpauseVault reset FeePeriodStart to the current block time, with a documented policy that no AUM fees accrue while paused. Fixes the broader accrual-during-pause ambiguity; rate changes while paused then only ever apply to post-unpause time.
Proposals A and C compose well together, and C may be worth doing regardless of which proposal addresses the rate change.
Whichever is chosen, add test coverage for: bips change on a paused vault, and fee settlement on the first reconcile after unpause.
Risk
Affects fee accounting correctness, not consensus safety. Low severity but operator/depositor-facing: silent retroactive rate application is the kind of behavior that is hard to explain after the fact.
Background
UpdateVaultAUMFeeBips(keeper/vault.go:550-570) reconciles outstanding fees before applying a new rate, so that time accrued under the old rate is settled at the old rate. That is the documented contract of the method.That contract breaks for paused vaults:
reconcileVault(keeper/reconcile.go:46-48) returnsnilimmediately whenvault.Paused, so the "reconcile before bips change" step silently does nothing, and the rate change proceeds anyway.UnpauseVault(keeper/msg_server.go:575) does not settle fees or resetFeePeriodStarteither.Problem
PauseVaultreconciles before pausing, leavingFeePeriodStartat pause time. If the fee rate is changed while the vault is paused, the next fee reconcile after unpause applies the new rate over the entire elapsed period sinceFeePeriodStart, including time that elapsed under the old rate. A rate increase retroactively overcharges depositors; a rate decrease undercharges the vault operator.This also leaves an undocumented policy gap: whether AUM fees should accrue during a pause at all is currently an accident of where
FeePeriodStartwas frozen, not a decision.Proposed changes
The following are proposals. One (or a combination) will be selected at implementation time.
UpdateVaultAUMFeeBipswhenvault.Paused, requiring unpause first. Smallest change, preserves the settle-before-change invariant by construction, but constrains operators.OutstandingAumFee, and resetFeePeriodStartbefore applying the new bips. Keeps the operation available without retroactive repricing, but adds a settlement path that runs against paused vaults.UnpauseVaultresetFeePeriodStartto the current block time, with a documented policy that no AUM fees accrue while paused. Fixes the broader accrual-during-pause ambiguity; rate changes while paused then only ever apply to post-unpause time.Proposals A and C compose well together, and C may be worth doing regardless of which proposal addresses the rate change.
Whichever is chosen, add test coverage for: bips change on a paused vault, and fee settlement on the first reconcile after unpause.
Risk
Affects fee accounting correctness, not consensus safety. Low severity but operator/depositor-facing: silent retroactive rate application is the kind of behavior that is hard to explain after the fact.