Build two ERC-4626 vaults over the same mock 18-decimal ERC-20 and measure the first-depositor (donation) inflation attack against each. Do not deploy.

NaiveVault: textbook ERC-4626, shares = assets x totalSupply / totalAssets with no virtual offset (1:1 when empty).

SafeVault: OpenZeppelin ERC4626 semantics with virtual shares and assets and a decimals offset passed as a constructor argument (uint8, 0 to 18; 6 is the recommended setting), rounding down on deposit and redeem and up on mint and withdraw per ERC-4626. Both use totalAssets() = the vault's token balance, so a direct transfer is a donation. This task is about reproducing and bounding the attack, unlike a plain vault build.

Scenario: the attacker deposits 1 wei, donates D, a victim deposits V, the attacker redeems everything. Tests show the attacker profits on NaiveVault (the victim gets 0 shares when V <= D) and never profits on SafeVault with offset 6 for any D and V up to 1e27. docs/inflation.md gives a table of attacker profit and victim loss for D in {1e18, 1e21, 1e24}, V in {1e18, 1e20} and offsets 0, 3 and 6, taken from a test that prints them.