DESCRIPTION
The target of this audit is the private code repository of UR Topup Contract Solana of Mantle. Please refer to the report for the detailed audit scope.
Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.
In summary, we have found that the codebase contains 4 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The UR Topup Contract Solana team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.
KEY FINDINGS
In total, we find 8 potential issues in the smart contract. We also have 4 recommendations and 2 notes, as follows:
| ID | Severity | Description | Status |
|---|---|---|---|
| 1 | High | Shared remaining_accounts causes conflict between Jupiter and LayerZero |
Fixed |
| 2 | High | Insufficient account space allocation for dynamic data | Fixed |
| 3 | High | Malicious constructed Jupiter swap_data and remaining_accounts might cause payer to lose funds |
Fixed |
| 4 | High | Unvalidated evm_output_token in cross chain messages will cause users to lose funds |
Fixed |
| 5 | Medium | Endpoint delegate is not synchronized when store.admin changes |
Fixed |
| 6 | Low | User-controlled fee_amount_via_usdc enables fee circumvention |
Fixed |
| 7 | Low | Lack of validation for user_input_token_account.mint versus swap input token |
Fixed |
| 8 | Low | Lack of option type check in the function init_store() |
Fixed |
| 9 | - | Non zero address checks | Fixed |
| 10 | - | Revise constant variable naming typos | Fixed |
| 11 | - | Add non zero value check for usdc_received |
Fixed |
| 12 | - | Lack of check in function set_usdc_mint() |
Confirmed |
| 13 | - | Payer should perform off-chain validation before signing |
- |
| 14 | - | Potential centralization risks | - |
More details are provided in the audit report.
