ERC-20 Cumulative Inflow Breaker

An unusually large deposit or donation can change a vault’s exposure or accounting. A cumulative inflow breaker rejects the candidate transaction that takes net inflow above the rolling limit.

Configuration

ERC20CumulativeInflowBreakerAssertion takes three constructor arguments:

Argument	Example	Meaning
`monitoredToken_`	Your underlying ERC-20 address	Token whose balance at the adopter is measured
`inflowThresholdBps_`	`2000`	20% of the window’s balance baseline
`inflowWindowDuration_`	`86400`	Rolling window in seconds: one day

Attach the assertion to the contract that holds the watched tokens. The adopter is set by deployment; it is not a constructor argument in this template. Use separate registrations for different tokens or custody addresses. The template does not validate constructor inputs. Add checks for the token and policy bounds. The window must be at least 10 seconds and fit in uint64. For an outflow cap, a threshold of 10,000 bps cannot reject a drain that only reaches 100%; the Balancer example rejects that configuration.

Behavior

watchCumulativeInflow maintains the rolling history in the executor. It invokes assertCumulativeInflow only when net inflow is strictly greater than the threshold. The callback checks the token context and reverts. A revert rejects the candidate transaction; it does not write a persistent pause flag to your protocol. Opposite-direction transfers offset the watched direction. The denominator is the window’s tvlSnapshot, not the current balance or a USD valuation. See bucket and baseline semantics.

Scenarios

Assume a 100,000-token baseline, a 20% limit, and all listed transfers within the retained window. Each row starts from that same baseline with no other flow.

Transfers	Net inflow	Result
19,999 tokens inflow	19,999	No breach
20,000 tokens inflow	20,000	No breach: equality is allowed
10,000, then 10,001 tokens inflow	20,001	Second transaction triggers rejection
25,000 inflow and 5,000 outflow	20,000	No breach after netting

Test and adapt

Local pcl test does not simulate rolling cumulative dispatch. Constructor tests and an armed callback test can verify configuration and rejection behavior, but they do not prove the table’s window behavior. Use an executor-backed environment to test accumulated transactions, equality, expiration, offsetting flow, and zero starting balance. An inflow limit can block deposits and repayments that improve protocol health. Exempting those paths requires a policy that identifies the actual operation and its effects. Token rebases, external strategy custody, and native ETH need their own accounting model. A net flow limit is not a gross-transfer or maximum-loss guarantee.

Source

Reviewed template.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

import {Assertion} from "credible-std/Assertion.sol";
import {AssertionSpec} from "credible-std/SpecRecorder.sol";
import {PhEvm} from "credible-std/PhEvm.sol";

contract ERC20CumulativeInflowBreakerAssertion is Assertion {
    address public immutable monitoredToken;
    uint256 public immutable inflowThresholdBps;
    uint256 public immutable inflowWindowDuration;

    constructor(address monitoredToken_, uint256 inflowThresholdBps_, uint256 inflowWindowDuration_) {
        registerAssertionSpec(AssertionSpec.Reshiram);

        monitoredToken = monitoredToken_;
        inflowThresholdBps = inflowThresholdBps_;
        inflowWindowDuration = inflowWindowDuration_;
    }

    function triggers() external view override {
        watchCumulativeInflow(
            monitoredToken,
            inflowThresholdBps,
            inflowWindowDuration,
            this.assertCumulativeInflow.selector
        );
    }

    /// @notice Reverts when cumulative token inflow breaches the rolling-window limit.
    /// @dev The Reshiram trigger tracks the window and calls this function only after breach.
    function assertCumulativeInflow() external view {
        PhEvm.InflowContext memory ctx = ph.inflowContext();
        require(ctx.token == monitoredToken, "ERC20Inflow: wrong token context");

        revert("ERC20Inflow: cumulative inflow breaker tripped");
    }
}

Start Here

Explanation

Patterns

Configuration

Behavior

Scenarios

Test and adapt

Source

​Configuration

​Behavior

​Scenarios

​Test and adapt

​Source

Configuration

Behavior

Scenarios

Test and adapt

Source