Nested vaults - usage and risks

I wrote up the nitty gritty of a workaround here: