Deposit USDC into a Morpho vault, a Yearn strategy, or a tokenized-treasury fund, and the experience looks the same: you hand over an asset, you receive a share token, and the interface quotes your position in a consistent way. That sameness is not an accident. It comes from ERC-4626, the tokenized vault standard that most serious DeFi vaults now speak. For developers, ERC-4626 vaults removed the need to reinvent deposit and withdrawal logic. For allocators, the standard is what makes an onchain position behave like a fund share.

This guide explains what ERC-4626 is, how its share accounting works, why it powers the composability behind the vault era, and what the newer extensions add for real-world assets. It also covers the security caveats, because a shared interface does not make every vault safe. If you want the broader context first, our complete guide to DeFi vaults sets the scene.

What Is ERC-4626, and What Problem Does It Solve?

ERC-4626 is a standard interface for yield-bearing vaults. A vault here is a smart contract that holds a single underlying ERC-20 asset, runs some strategy with it, and issues share tokens representing each depositor's claim. The standard defines how deposits, withdrawals, and share pricing work, so any compliant vault looks the same to the protocols that integrate it. It was finalized in April 2022, authored by contributors including Joey Santoro of Fei Protocol.

The detail that makes it powerful is simple. An ERC-4626 vault share is itself an ERC-20 token. The vault extends the token standard rather than sitting beside it, so a share can move, trade, and plug into other protocols like any other token.

Before the standard existed, every yield protocol built its own vault logic. Each had a different way to deposit, a different way to read a balance, and a different accounting model. That created integration silos, inconsistent share math, and duplicated audit work, since each bespoke design had to be reviewed from scratch. ERC-4626 replaced that fragmentation with one predictable interface.

How Does ERC-4626 Share Accounting Work?

The core of the standard is the relationship between assets and shares. Assets are the underlying token the vault holds, such as USDC. Shares are what you receive when you deposit. The share price is the ratio of total assets to total shares, and it moves as the vault earns yield.

When you deposit, the vault mints shares to you based on the current ratio. When you exit, you either withdraw a specific amount of the underlying asset or redeem a specific number of shares, and the vault burns shares accordingly. The standard also includes quoting functions that let an integrator preview how many shares a deposit would mint, or how many assets a redemption would return, which is what allows wallets and aggregators to display accurate numbers.

Under the hood, the standard defines a small, predictable set of actions. Four methods handle movement in and out: deposit and mint to enter, withdraw and redeem to leave, with the pair in each case letting a caller specify either the asset amount or the share amount. A second set of view functions, the convert and preview helpers, lets any integrator compute the exact exchange between assets and shares before sending a transaction. Because every compliant vault exposes the same functions, an aggregator can add a new vault without writing custom code for it.

A short example makes the accounting concrete. Suppose a vault holds 1,000 USDC against 1,000 shares, so each share is worth one USDC. The strategy earns 100 USDC, lifting total assets to 1,100 while the share count stays at 1,000. Each share is now worth 1.10 USDC, and a holder who redeems gets back the larger amount. Yield shows up as a rising share price rather than as new tokens appearing in your wallet.

For an institutional reader, this is the onchain version of net asset value per share. A traditional fund tracks NAV per unit; an ERC-4626 vault tracks assets per share with the same logic, except the accounting lives in a public smart contract that anyone can read in real time.

Why ERC-4626 Matters: Composability and the Vault Era

Because a vault share is an ERC-20, it can be used anywhere an ERC-20 is accepted. That single property is what turned vaults into building blocks. Lending markets such as Morpho, Aave, and Euler can accept vault shares as collateral, which lets you deposit an asset, earn yield on it, and borrow against the share at the same time. Aggregators can route deposits into any compliant vault and display yields consistently. Wallets can read balances and exchange rates through one interface.

The practical result is that yield positions stack. Deposit USDC into a compliant vault, receive shares that keep earning, then post those shares as collateral in a lending market and borrow against them, all without leaving the standard. Auto-compounding vaults take the same idea further, harvesting rewards and reinvesting them into the underlying strategy so the share price climbs without the holder doing anything. The interface stays identical whether the vault runs a simple lending strategy or a complex multi-strategy allocator, which is what lets so many products interoperate.

This composability is why the standard spread so quickly. By April 2026, total value locked across ERC-4626 vaults sat in the region of $25 billion, spanning protocols like Morpho, Yearn v3, Pendle, and a growing set of tokenized-treasury wrappers, with stablecoin vaults alone numbering in the thousands. Aave v3 exposes its supplied-asset tokens with 4626-compatible semantics, and Morpho's curator vaults are built around the standard. New yield primitives now treat ERC-4626 as the default interface rather than an optional one.

The standard also clarified vault design. With a common interface, teams can focus on the strategy inside the vault instead of the plumbing around it, and integrators can reason about many vaults the same way. Our breakdown of how vault architectures differ shows how much variation still exists inside that shared wrapper.

For institutional allocators, the quiet benefit is accounting. A standardized share price that updates onchain gives a fund admin a clean, verifiable number to mark positions against, rather than a bespoke balance that has to be reverse-engineered from each protocol. Because the share is a transferable ERC-20, custody and transfer fit existing token workflows, and because conversions are public functions, an auditor can reconstruct the position independently. Standardization does not remove the need for digital-asset-capable fund operations, but it does make the position legible in a way bespoke vaults never were.

ERC-7540 and the Extensions for Real-World Assets

The base standard assumes deposits and redemptions settle in the same transaction. That works for onchain assets but breaks for anything with off-chain settlement. A tokenized T-bill cannot be redeemed instantly, because the underlying bill settles on a delay.

ERC-7540, finalized in 2024, extends ERC-4626 to support asynchronous flows. Instead of an instant deposit or redemption, a user submits a request that moves through stages: pending, then claimable once the vault settles it, then claimed when the user finalizes the transaction onchain. This is the interface that tokenized-treasury issuers and credit funds needed, and it is already used in production by RWA platforms such as Centrifuge, Ondo, and Backed, where a redemption may involve T-plus settlement or off-chain confirmation.

Two related standards round out the picture. ERC-7575 addresses vaults that hold more than one underlying asset, such as a liquidity-pool position. And in regulated settings, ERC-4626 vaults are often paired with permissioning standards like ERC-3643 to gate who can deposit, which is how compliant, identity-checked pools keep investor eligibility while preserving the familiar share interface. The same machinery underpins the tokenized-treasury vaults institutions are increasingly using.

This combination is what makes the standard viable for regulated capital. A permissioned ERC-4626 vault can restrict transfers to whitelisted, identity-verified investors, settle redemptions asynchronously to match an off-chain asset, and still expose the same share interface that aggregators and accounting systems already understand. A fund gets compliance controls and onchain composability in one structure, rather than choosing between them. That is why tokenized-treasury and private-credit issuers converged on the 4626 family rather than building closed, proprietary systems.

What Are the Security Risks of ERC-4626 Vaults?

A shared standard removes a class of integration bugs, but it does not make a vault safe. The most cited risk is the inflation attack, sometimes called a donation or first-depositor attack, which hit several early implementations. The mechanics: an attacker deposits a tiny amount, then sends a large amount of the underlying asset straight to the vault to inflate the share price, so that a later depositor's rounding loss can be captured. Modern implementations defend against this with virtual shares and an offset, or by seeding the vault with locked dead shares, and by tracking balances internally rather than reading the raw token balance.

Rounding direction is part of the same story. A well-built vault rounds in its own favor on every conversion, so that small discrepancies accrue to the protocol rather than to an attacker. These are fine details, but they are the kind that separate an audited vault from a risky one.

The larger caveat is conceptual. ERC-4626 standardizes the interface, not the strategy. A vault can be fully compliant and still run a dangerous strategy, depend on a fragile oracle, or carry concentrated counterparty risk. Composability cuts both ways, since a share used as collateral ties the lending market's solvency to the vault's behavior, so a problem in one place can spread to another.

The asynchronous extensions add their own surface. Deferred settlement introduces timing and trust assumptions the atomic version avoids: between a redemption request and its fulfillment, the value of the underlying can move, the settling party has to behave honestly, and a holder waiting in the claimable stage carries exposure they cannot exit instantly. For real-world-asset vaults, where settlement may depend on an off-chain wire or a custodian, the operational trust is part of the risk, not separate from it. None of this argues against the standard. It argues for diligence on the specific vault, which our 10-question framework for picking a vault is built to support.

Conclusion

ERC-4626 is the plumbing standard that made the vault era possible. By giving every yield vault the same deposit, withdrawal, and share-pricing interface, it turned isolated strategies into composable building blocks, and it gave allocators onchain positions that read like fund shares. The extensions for asynchronous settlement now bring the same model to tokenized treasuries and credit, widening where ERC-4626 vaults can go.

The standard guarantees the interface, not the safety of what sits behind it. That distinction is the whole point: judge the strategy, the audits, and the risk controls of each vault, not just its compliance with the spec. Platforms like Lucidly Finance build on these standard rails while adding the curation and institutional-grade risk frameworks the interface itself does not provide.