Fair Casino Solana Vault Program
Zealynx audited the Fair Casino Solana vault program, a non-custodial token custody and withdrawal-management system using PDA-based vaults, Ed25519 signature verification via instruction introspection, replay protection, and two-step authority transfers. The two-week review identified 5 issues including 1 High (initialization frontrunning enabling complete vault takeover) and 1 Medium (missing token account constraints). All findings were fixed and verified.
Scope
1 file · 280 SLOCFindings
click any row for the full write-upKey Findings
- Missing vault initialization authorization enables complete takeover. The
initialize_vaultfunction does not validate the caller's identity, allowing anyone to become the vault authority. Since Solana programs require manual initialization, an attacker who frontruns the legitimate deployment can gain complete control over the vault including all administrative operations and user deposits with no recovery mechanism. - Missing token account constraints leads to potential unauthorized transfers. The
ProcessWithdrawalinstruction context fails to validate critical properties of the token accounts used in withdrawal operations. Specifically,vault_token_accountandrecipient_token_accountlack constraints verifying ownership and mint matching, creating opportunities for confusion attacks and potential transfers of unintended token types. - Single-step authority transfer risks permanent loss of control. The vault implements authority transfer functions that immediately transfer control in a single transaction without requiring confirmation from the new authority. A single typographical error during authority transfer can result in permanent loss of vault control and all deposited funds with no recovery mechanism.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
