# M09-L01 — Lab contract

**Build:** On Anvil only, test vulnerable vault, then CEI and guard fixes.

**Pass:** Vulnerable test reproduces issue; fixed version prevents over-withdraw.

**Failure injection:** Attacker can repeatedly withdraw before balance decrement.

**Review question:** Why is CEI necessary but not universally sufficient?

Status: specification; only count as executable when source and tests are present and verified.