Tablet

The share, and the number it is not

A Tablet is an ERC‑20 standing for a claim on a vault. Its price is totalAssets / totalSupply, it does not fall, and this page is mostly about why that second fact is less useful than it sounds.

written The vault contract exists as source. It is not deployed anywhere.

The identity

sharePrice = (totalAssets + virtualAssets) / (totalSupply + virtualShares)

Three properties come straight out of that line and none of them needs a key, an oracle or a keeper.

A stray transfer changes nothing. totalAssets is a storage variable, incremented by deposits and harvests. It is never balanceOf(address(this)), so tokens sent to the vault by accident or on purpose are invisible to pricing.
The first depositor cannot round the second to zero. The virtual offsets keep the ratio finite when the real supply is one wei.
Redemption is symmetric. Burning s shares returns s × sharePrice of the asset, computed the same way, with no owner check on the path.

Those two guarantees interact, and the order matters. Once donations are invisible to pricing, the classic inflation attack — deposit one wei, donate a large amount, watch the next depositor mint zero — cannot be primed at all, because the donation does not move the price. The virtual share is then defence in depth rather than the primary control. Documentation in this category routinely presents the attack narrative and the storage-accounting guarantee on the same page without noticing that the second makes the first impossible as written.

Claiming ERC‑4626 means passing it

The standard requires maxDeposit, maxMint, maxWithdraw and maxRedeem, and it requires that they MUST NOT revert. They are the four functions an integrator calls first and the four that vaults in this category most often omit while advertising the standard in a trust strip. When they are missing, the first call an aggregator makes reverts — and the vault’s own ABI, which never declared them, cannot detect that its claim is false.

Nacre’s vault implements all four. Nothing is deployed and no source is published yet, so the honest form of that sentence is: the interface is written and it is not running anywhere. That is rule 8, and it is one of the 10 enforced here by a build check — standards-scoped, which holds the claim scoped even though a file-level validator can never call a contract to confirm it.

Lustre

The decomposition

The share price is one term. Here are the others.

return = price move + gross fees − divergence − protocol cut − gas

Term	Sign	Size	What it is
The asset's own move	±	dominant	You hold exposure to the pool asset. Over any horizon that matters this term is larger than every other one combined, and it is the term no vault has any influence over. It is signed either way.
Gross fee income	+	the only positive term	Swap fees collected by the position. This is the number the category quotes, usually annualised from a window short enough to flatter it.
Divergence loss	−	usually the largest negative	The value given up by holding a liquidity position instead of the two assets. On a concentrated range it is larger than on a full-range one, and it grows with the size of the price move, not its direction. Under storage accounting THE SHARE PRICE CANNOT SEE THIS TERM.
Protocol cut	−	stated, capped	The share of harvested fees the protocol keeps. Nacre publishes it as a rate, a basis, and a hard cap — three numbers, because a rate without a basis is not a fee.
Gas and rebalancing	−	small, real, never quoted	Approvals, deposits, redemptions, and whatever the position costs to keep in range. Small per transaction and not zero, which is a different thing from the zero it is usually given in a projection.

Term

Sign

Size

What it is

The asset's own move

dominant

You hold exposure to the pool asset. Over any horizon that matters this term is larger than every other one combined, and it is the term no vault has any influence over. It is signed either way.

Gross fee income

the only positive term

Swap fees collected by the position. This is the number the category quotes, usually annualised from a window short enough to flatter it.

Divergence loss

−

usually the largest negative

The value given up by holding a liquidity position instead of the two assets. On a concentrated range it is larger than on a full-range one, and it grows with the size of the price move, not its direction. Under storage accounting THE SHARE PRICE CANNOT SEE THIS TERM.

Protocol cut

−

stated, capped

The share of harvested fees the protocol keeps. Nacre publishes it as a rate, a basis, and a hard cap — three numbers, because a rate without a basis is not a fee.

Gas and rebalancing

−

small, real, never quoted

Approvals, deposits, redemptions, and whatever the position costs to keep in range. Small per transaction and not zero, which is a different thing from the zero it is usually given in a projection.

Under storage accounting the share price cannot see the divergence term. totalAssets moves on deposit, on withdrawal and on harvest, and on nothing else. If the liquidity position underneath the vault is worth less than the credited total, the price does not know: redemption at the computed price pays whoever redeems early in full and leaves the shortfall with whoever is last. That is the central unresolved question in this design and it is listed as such on Umbo rather than resolved in a sentence here.

Lifecycle

Four calls

01 Deposit

You send the pool asset to the vault. It is credited to a storage variable, so a stray transfer into the contract changes nothing for anyone holding a share.

02 Mint

The vault mints Tablets at the current price. The first deposit is 1:1; every later one pays what a share is already worth, plus a virtual share so the first depositor cannot round the second down to zero.

03 Epitaxy

The hook credits collected swap fees to the vault. The protocol cut is taken first, at a rate the contract caps; the rest raises every share by the same factor, in register, which is what the word means.

04 Redeem

Burn the share, take the underlying at the current price. No epoch, no queue and no owner check on the path — a claim about this contract and not about wherever the assets are ultimately deployed.