專案簡介
The target of this audit is the private code repository of UR Topup Contract Solana of Mantle. Please refer to the report for the detailed audit scope.
Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.
In summary, we have found that the codebase contains 4 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The UR Topup Contract Solana team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.
關鍵發現
我們在該智能合約中共發現 8 個潛在問題，另有 4 條建議與 2 條說明，明細如下：
| ID | Severity | Description | Status |
|---|---|---|---|
| 1 | High | Shared remaining_accounts causes conflict between Jupiter and LayerZero |
Fixed |
| 2 | High | Insufficient account space allocation for dynamic data | Fixed |
| 3 | High | Malicious constructed Jupiter swap_data and remaining_accounts might cause payer to lose funds |
Fixed |
| 4 | High | Unvalidated evm_output_token in cross chain messages will cause users to lose funds |
Fixed |
| 5 | Medium | Endpoint delegate is not synchronized when store.admin changes |
Fixed |
| 6 | Low | User-controlled fee_amount_via_usdc enables fee circumvention |
Fixed |
| 7 | Low | Lack of validation for user_input_token_account.mint versus swap input token |
Fixed |
| 8 | Low | Lack of option type check in the function init_store() |
Fixed |
| 9 | - | Non zero address checks | Fixed |
| 10 | - | Revise constant variable naming typos | Fixed |
| 11 | - | Add non zero value check for usdc_received |
Fixed |
| 12 | - | Lack of check in function set_usdc_mint() |
Confirmed |
| 13 | - | Payer should perform off-chain validation before signing |
- |
| 14 | - | Potential centralization risks | - |
更多細節見審計報告。
