Concrete (Blueprint Finance)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED because Concrete is programmable vault infrastructure whose owner and strategy set determine the actual investment. An ERC-4626 share is not a uniform risk class: one Concrete vault may route to Morpho, another to Pendle or a cross-chain strategy, and the factory can support synchronous or asynchronous exits. The adviser would be delegating allocation, strategy admission, deallocation order and incident response to privileged operators while retaining responsibility for every inherited protocol exposure. The current audit record is substantial and shows findings were remediated, but it also makes the control tradeoff concrete: owner-only strategy retirement, accepted reliance on trusted strategies, deliberate withdrawal reverts when a strategy fails, and preview/accounting paths that required multiple fixes. Reject at the protocol level. Reopen only a named vault whose live strategies, authorities, audits and proposed-size exit are independently pinned and whose allocation rule adds a defensible benefit over direct approved positions.

Kill criteria: the events that revoke this verdict
• Any live strategy, proxy implementation or privileged module is not mapped to a current audit and verified commit
• Any underlying strategy lacks its own current approval or exceeds its approved allocation limit
• A strategy revert, bridge delay or epoch process prevents a proposed-size withdrawal inside the written time limit
• Any unannounced strategy, owner, signer threshold, timelock, fee or deallocation-order change
• Vault accounting differs from independently reconciled underlying balances by more than 10 basis points

The research file

Mechanism and return source

Concrete deploys tokenized vaults that accept one underlying asset and issue shares while allocating capital across modular strategy contracts. The vault accounts for aggregate assets, fees and withdrawal capacity; each strategy interacts with an external venue and reports assets back to the vault. Returns therefore come from the admitted strategies, not from ERC-4626 itself.

Standard vaults support synchronous redemption when idle cash and strategy liquidity are sufficient. The separately audited asynchronous implementation uses epochs and reserved assets for strategies whose exits cannot settle in one transaction. A client-facing memo must name the exact vault, implementation, underlying, strategy list, caps and fee schedule; “Concrete yield” is not a reproducible exposure.

Control and governance

The audits describe privileged owner and operator functions over strategy admission, allocation, deallocation order, pausing, upgrades, fee configuration and strategy retirement. One strategy review explicitly flags that an owner can retire a strategy and pull its assets without a built-in notice delay, recommending a multisig and timelock. Later core reviews test broader role separation, but the live owner, signer threshold and delay are deployment-specific facts.

Concrete told Cantina that strategies are trusted, audited and actively maintained components and accepted a finding where withdrawal accounting trusted the strategy-reported return value. That is a clear trust boundary: an adviser must underwrite both the vault control plane and every external strategy implementation.

Security and incident record

Protocol-hosted reports document Zellic, Halborn and Cantina reviews across the vault, standard core, asynchronous core and strategies. The reports identify and generally verify fixes for withdrawal blockage, missing output checks, accounting and preview mismatches, initialization, deallocation ordering and strategy-return assumptions. No confirmed production principal loss attributable to Concrete was identified in the reviewed primary record.

That bounded negative finding is not an incident guarantee. The audit scopes and dates differ, and a later strategy or upgrade is not covered merely because the framework was audited. Approval requires mapping the live proxy implementation, every strategy and each privileged module to a report and remediated commit.

Exit and liquidity

Exit depends on idle assets plus successful deallocation from each strategy in the configured order. Zellic found and the team fixed a Morpho strategy path that could block withdrawals when the strategy already held enough of the requested asset. Cantina later documented that one reverting strategy intentionally causes the full pending withdrawal process to revert until an operator removes the faulty strategy from the deallocation queue.

The asynchronous implementation adds epoch processing and asset reservation. Reported fixes reduce known accounting defects, but they do not make an async claim atomically liquid. A proposed-size test must record immediate redeemable assets, queued shares, settlement epoch, each downstream unwind and any bridge or market liquidity constraint.

Comparison and decision

Compared with a direct approved lending position, Concrete can automate routing and combine venues but removes the client’s ability to choose and size each risk independently. Compared with a Morpho vault, Concrete is a broader framework whose strategies may extend beyond isolated lending markets; the extra flexibility is also a wider admission and monitoring burden. Compared with a static index, its strategy set and deallocation order are operator-controlled rather than a fixed replicable methodology.

Reject the protocol-wide abstraction. A named vault can be reconsidered only as its own product. Convenience and headline APY cannot offset an unbounded strategy set or an exit that depends on discretionary operator repair.

Observable reopening conditions

For a named vault, publish the live implementation hash, owner and signer threshold, timelocks, pausers, fee roles, strategy list, caps, deallocation order and audit-to-commit map. Require every underlying strategy to pass its own Ketju review, prohibit unannounced strategy additions, and demonstrate a proposed-size withdrawal through the full downstream unwind inside a written time and cost limit. Any strategy revert, accounting discrepancy, bridge dependency or admin change reopens the decision immediately.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Concrete documentation — protocol and vault materials · primary · accessed 2026-08-14
  Supports: vault infrastructure, strategy composition, protocol documentation
• Zellic — Concrete smart-contract security assessment · primary · accessed 2026-08-14
  Supports: vault architecture, Morpho withdrawal finding, remediation
• Halborn — Earn V2 standard implementation assessment · primary · accessed 2026-08-14
  Supports: standard vault, strategy accounting, withdrawal preview, remediated findings
• Halborn — Earn V2 asynchronous implementation assessment · primary · accessed 2026-08-14
  Supports: asynchronous withdrawals, epoch accounting, pause adjustment, remediated findings
• Cantina — Concrete Finance review · primary · accessed 2026-08-14
  Supports: trusted strategy assumption, withdrawal revert, deallocation order, accounting trust
• Concrete strategy assessment — owner retirement control · primary · accessed 2026-08-14
  Supports: owner-only strategy retirement, timelock recommendation, centralization risk

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.