<style> @import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap'); /* Header and Footer Styles */ .header { position: running(header); padding: 5px 20px; border-bottom: 1px solid rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: space-between; background: white; } .footer { position: running(footer); padding: 5px 20px; border-top: 1px solid rgba(0,0,0,0.1); text-align: center; font-size: 12px; background: white; } .header img { max-height: 30px; } .header span, .footer span { color: #304EEB; font-weight: 500; } /* Print styles for PDF export */ @page { margin-top: 20mm; margin-bottom: 20mm; @top { content: element(header); } @bottom { content: element(footer); } } .markdown-body { margin-top: 0; margin-bottom: 0; } /* Page number in footer */ .footer::after { content: counter(page) " of " counter(pages); display: block; margin-top: 5px; } /* ===== OShield Theme ===== */ body, .markdown-body { color: #1a1a1a; font-family: "Inter", system-ui, -apple-system, Segoe UI, Roboto, sans-serif; line-height: 1.6; } /* Headings */ .markdown-body h1, .markdown-body h2, .markdown-body h3, h1, h2, h3 { color: #304EEB; font-weight: 600; line-height: 1.2; } /* Links */ .markdown-body a { color: #304EEB; text-decoration: underline; } /* Blockquote */ .markdown-body blockquote { border-left: 4px solid #304EEB; padding-left: 12px; color: #304EEB; font-style: italic; } /* Code */ .markdown-body pre code { border-radius: 6px; padding: 0.8rem 1rem; font-size: 14px; } /* Table */ .markdown-body table { border-collapse: collapse; } .markdown-body th, .markdown-body td { border-bottom: 1px solid rgba(0,0,0,0.1); padding: 8px 10px; } .markdown-body th { color: #304EEB; text-align: left; } /* Slide Mode (reveal.js) */ .reveal { color: #1a1a1a; font-family: "Inter", sans-serif; font-size: 20px; } .reveal .slides > section { padding: 48px 56px; } .reveal h1, .reveal h2, .reveal h3 { color: #304EEB; font-weight: 600; } </style> <!-- Header --> <div class="header"> <img src="https://hackmd.io/_uploads/rJG4RVnqex.png" alt="OShield Logo"> <span>Solflare Audit Report</span> </div> <!-- Footer --> <div class="footer"> <span>Consult The <a href="https://www.oshield.io/" style="color: #304EEB; text-decoration: none;">OShield</a> | &copy; 2025 OShield</span> </div> ![client oshield](https://hackmd.io/_uploads/ryNyUtdcex.png) # Solflare Audit Report <p style="font-style: italic; text-align: center;">When you ship, Consult The <a href="https://www.oshield.io/" style="color: #0052cc; text-decoration: none;">OShield</a></p> Bluewolf : blue@oshield.io David : david@oshield.io Mkib : mikb@oshield.io Conducted between [Start Date] and [End Date] of [Year] **Issued:** [Date], [Year] <div style="page-break-after: always;"></div> ## Executive Summary Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus ac convallis sem, sed mattis mi. Ut vitae nulla eget velit tempor blandit a eu risus. Vivamus eget erat erat. Suspendisse sit amet porttitor nisl. Integer ut tempus lacus, vitae sagittis lacus. Sed vestibulum sem et elementum rutrum. Donec ut interdum mi. Fusce id leo ac libero posuere aliquet. Nunc bibendum felis at urna eleifend elementum. Donec consequat nisi nec diam rutrum tincidunt. Fusce sit amet lacinia turpis, id consectetur felis. Nam nec risus consequat diam dignissim fringilla id vel libero. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices. ## Table of Contents [TOC] ## Introduction Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus ac convallis sem, sed mattis mi. Ut vitae nulla eget velit tempor blandit a eu risus. Vivamus eget erat erat. Suspendisse sit amet porttitor nisl. Integer ut tempus lacus, vitae sagittis lacus. Sed vestibulum sem et elementum rutrum. Donec ut interdum mi. Fusce id leo ac libero posuere aliquet. Nunc bibendum felis at urna eleifend elementum. Donec consequat nisi nec diam rutrum tincidunt. Fusce sit amet lacinia turpis, id consectetur felis. Nam nec risus consequat diam dignissim fringilla id vel libero. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices. <div style="page-break-after: always;"></div> ## Findings & Recommendations Our severity classification system adheres to the criteria outlined here. | Severity Level | Exploitability | Potential Impact | Examples | |----------------|----------------|------------------|-----------| | 🔴 Critical | Low to moderate difficulty, 3rd-party attacker | Irreparable financial harm | Direct theft of funds, permanent freezing of tokens/NFTs | | 🟠 High | High difficulty, external attacker or specific user interactions | Recoverable financial harm | Temporary freezing of assets | | 🟡 Medium | Unexpected behavior, potential for misuse | Limited to no financial harm, non-critical disruption | Escalation of non-sensitive privilege, program malfunctions | | đŸ”ĩ Low | Implementation variance, uncommon scenarios | Zero financial implications, minor inconvenience | Program crashes in rare situations | | ℹī¸ Informational | N/A | Recommendations for improvement | Design enhancements, best practices | ### Findings Summary | Finding | Description | Severity Level | |---------|-------------|----------------| | [EXEMPLE-C1] | Exemple | 🔴 Critical | | [EXEMPLE-H1] | Exemple | 🟠 High | | [EXEMPLE-M1] | Exemple | 🟡 Medium | | [EXEMPLE-L1] | Exemple | đŸ”ĩ Low | ### Findings Description #### EXEMPLE-C1: EXEMPLE ##### Description Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Impact Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Implemented Solution Lorem ipsum dolor sit amet, consectetur adipiscing elit. --- #### EXEMPLE-H1: EXEMPLE ##### Description Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Impact Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Implemented Solution Lorem ipsum dolor sit amet, consectetur adipiscing elit. --- #### EXEMPLE-M1: EXEMPLE ##### Description Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Impact Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Implemented Solution Lorem ipsum dolor sit amet, consectetur adipiscing elit. --- #### EXEMPLE-L1: EXEMPLE ##### Description Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Impact Lorem ipsum dolor sit amet, consectetur adipiscing elit. ##### Implemented Solution Lorem ipsum dolor sit amet, consectetur adipiscing elit. --- ## Protocol Overview Lorem ipsum dolor sit amet, consectetur adipiscing elit. Phasellus ac convallis sem, sed mattis mi. Ut vitae nulla eget velit tempor blandit a eu risus. Vivamus eget erat erat. Suspendisse sit amet porttitor nisl. Integer ut tempus lacus, vitae sagittis lacus. Sed vestibulum sem et elementum rutrum. Donec ut interdum mi. Fusce id leo ac libero posuere aliquet. Nunc bibendum felis at urna eleifend elementum. Donec consequat nisi nec diam rutrum tincidunt. Fusce sit amet lacinia turpis, id consectetur felis. Nam nec risus consequat diam dignissim fringilla id vel libero. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices. <div style="page-break-after: always;"></div> ## Methodology Our audit methodology for the [NAME] protocol followed a systematic approach: 1. **Initial Code Review**: Comprehensive examination of the Move codebase to understand the protocol's architecture, components, and core functionality. 2. **Mathematical Verification**: Detailed analysis of the mathematical foundations, including liquidity calculations, price impact formulations, and token conversion mechanisms. 3. **Threat Modeling**: Identification of potential attack vectors, focusing on economic exploits, manipulation possibilities, and edge cases. 4. **Vulnerability Testing**: Development of specific test cases to verify identified vulnerabilities, particularly the decimal normalization issue which was thoroughly validated through both mathematical analysis and testnet experimentation. 5. **Architectural Analysis**: Creation of protocol diagrams to visualize component relationships and data flows, enhancing our understanding of potential security boundaries and interaction points. 6. **Recommendations Development**: Formulation of specific, actionable remediation steps for each identified vulnerability. ## Scope and Objectives The primary objectives of the audit are defined as: - Ensure the protocol's core functionality operates as expected under various conditions and edge cases. - Minimizing the possible presence of any critical vulnerabilities in the program. This would include detailed examination of the code and edge case scrutinization to find as many vulnerabilities. - 2-way communication during the audit process. This included for OShield to reach a perfect understanding of the design of the system and the goals of the team. - Provide clear and thorough explanations of all vulnerabilities discovered during the process with potential suggestions and recommendations for fixes and code improvements. - Clear attention to the documentation of the vulnerabilities with an eventual publication of a comprehensive audit report to the public audience for all stakeholders to understand the security status of the programs. ## Repository Information | Item | Details | |------|---------| | Repository URL | [Link](link) | | Commit (start of audit) | [commit](link) | | Commit (end of audit) | TBD | #### Files: