This is not an audit badge. It is a record of attempts, run against a fork of Robinhood Chain mainnet with the real NVDA and USDG pool and the real Chainlink NVDA feed, because a guard that only holds against a mock is not a guard.
Each row is one test in test/ForkManagedFund.t.sol, written from the manager's side, trying to get paid.
There is no door. The only path that moves value out of a fund is withdraw, and withdraw pays the caller a proportional slice of the shares the caller holds. The manager holds none of the depositor's, so the call dies on NoShares and their balance at the end of it is still zero.
Both sides of every trade have to be on a list fixed when the fund was built. The fresh token is not on that list, so the trade is refused with NotAllowed before any money moves. This is also why a fund here can only hold stock: the moment any token can be bought, any token can be used to steal, and no guard can tell the two apart.
The test knocks on the five doors an escape hatch usually hides behind: execute, call, multicall, sweep, rescue. None of them are there. No function anywhere in the fund takes a target address or calldata, so this attempt cannot even be written down.
The depositor, whose money it actually is, tries to move it herself. NotManager. Permission to trade and ownership of the money are two separate things in this contract, and neither one can reach across into the other.
This is how trading vaults are really drained. The manager sets the slippage limit to zero, accepts a dreadful price, and collects the difference as the other side of the trade. A fund that only honours the manager's own promise waves this through, so this one measures the price the trade actually got and checks it against Chainlink afterwards. The fill was refused, and the fund is holding no NVDA at the end of it.
The five refusals are worth nothing if the fund no longer works. So the last one is the ordinary day: money in, NVDA bought at the real pool price, and the investor withdrawing her exact proportional slice of what the fund is holding.
A fork gives real liquidity, but the price on a fork only does what the market did that day. To ask what a manager earns when a fund doubles, and what they earn when it halves, the feed has to be one the test can push around. All eight of these are in test/ManagedFund.t.sol.
A stock feed updates 24 hours a day, 5 days a week, and stops outright while a corporate action is being processed. The pools never stop. So for most of any given week there is no honest price for a fund that holds stock, and the contract splits that problem in two.
Handing out new shares needs a price, and a guessed one hands the difference to whoever deposits at exactly the right moment. So the fund says no until the feed is warm again.
Your payout is a proportional slice of every holding, which needs no price at all. A closed market can never trap you in somebody else's fund.
The only thing in the whole fund that needs a price is the fee. When the fund cannot be priced you still leave with your exact slice, and the manager simply gets nothing.
Nothing here needs anything from us. The fork test dials Robinhood Chain's public RPC itself.