defirisk.co
rubric v1.7.0

ERC-4626 virtual-share offset (OZ ≥4.9)

Sushi (SushiSwap) — v2 + v3 + Trident + BentoBox/Kashi + SushiXSwap's assessment for RD-F-074 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

BentoBox is NOT an ERC-4626 vault. It predates the ERC-4626 standard and implements a custom deposit()/withdraw() mechanism using a Rebase struct (elastic/base share model). No _decimalsOffset() pattern; no OpenZeppelin ERC-4626 inheritance. Profile §11 explicitly confirms: 'BentoBox is NOT ERC-4626 — F074 N/A.' No ERC-4626 vault exists anywhere in the Sushi v2, v3, or BentoBox codebase. Not applicable.

Sources #

  • GitHub
    BentoBox.sol — confirms non-ERC-4626 architecturesushiswap/bentobox BentoBox.sol: deposit(IERC20 token_, address from, address to, uint256 amount, uint256 share) — custom rebase model; no ERC-4626 interfaceretrieved 2026-05-17
  • Internal
    Protocol profile §11 explicit N/A declaration.research/protocols/sushi/00-profile.md §11: BentoBox is NOT ERC-4626 — F074 N/Aretrieved 2026-05-17

Methodology #

Determine whether ERC-4626 vaults use OpenZeppelin ≥4.9 virtual-share offset pattern to prevent first-depositor share-inflation.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol sushi factor RD-F-074 score not_applicable collected_at 2026-05-16 19:50:37