osec-solana-medium

00.1 — Scope

SOL1-account-info-instead-of-signer: exploit tx should have been rejected — EmergencySetAdmin uses `caller: Signer<'info>` with no has_one or admin check, allowing any signer to call emergency_set_admin and hijack the router admin. See programs/vault_router/src/lib.rs EmergencySetAdmin struct.

#[test]
pub fn test_sol1_account_info_instead_of_signer_litesvm() {
    let program_id = "3hFd1YxjyvXe43egY8PkYS9UrroJDmZBSuMAeYLhciwx"
        .parse::<Pubkey>()
        .unwrap();

    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/vault_router.so"
    ).expect("Failed to read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    // Keypairs
    let admin = Keypair::new();
    let attacker = Keypair::new();
        // …setup truncated for brevity…

    // Post-patch invariant: a patched program should REJECT this transaction
    // because the caller is not the router's admin. On the buggy code, the
    // transaction succeeds (any signer can hijack admin), so the assertion fails.
    assert!(
        exploit_result.is_err(),
        "SOL1-account-info-instead-of-signer: exploit tx should have been rejected — \
        EmergencySetAdmin uses `caller: Signer<'info>` with no has_one or admin check, \
        allowing any signer to call emergency_set_admin and hijack the router admin. \
        See programs/vault_router/src/lib.rs EmergencySetAdmin struct."
    );
}

--- a/programs/vault_router/src/lib.rs
+++ b/programs/vault_router/src/lib.rs
@@ -219,29 +219,29 @@
     pub vault: Account<'info, Vault>,
     #[account(mut, seeds = [b"position", vault.key().as_ref(), owner.key().as_ref()], bump = position.bump)]
     pub position: Account<'info, Position>,
-    /// CHECK: the position owner is used as a seed but is not required to sign.
-    pub owner: UncheckedAccount<'info>,
+    pub owner: Signer<'info>,
 }
 
 #[derive(Accounts)]
 pub struct Rebalance<'info> {
+    #[account(has_one = admin @ VaultError::BadFee)]
     pub router: Account<'info, Router>,
-    #[account(mut)]
+    #[account(mut, has_one = router @ VaultError::BadFee)]
     pub route: Account<'info, Route>,
-    #[account(mut)]
+    #[account(mut, has_one = router @ VaultError::BadFee)]
     pub source_vault: Account<'info, Vault>,
-    #[account(mut)]
+    #[account(mut, has_one = router @ VaultError::BadFee)]
     pub target_vault: Account<'info, Vault>,
-    #[account(mut)]
+    #[account(mut, has_one = router @ VaultError::BadFee)]
     pub fee_vault: Account<'info, Vault>,
-    pub operator: Signer<'info>,
+    pub admin: Signer<'info>,
 }
 
 #[derive(Accounts)]
 pub struct EmergencySetAdmin<'info> {
-    #[account(mut)]
+    #[account(mut, has_one = admin @ VaultError::BadFee)]
     pub router: Account<'info, Router>,
-    pub caller: Signer<'info>,
+    pub admin: Signer<'info>,
 }
 
 #[derive(Accounts)]

SOL2-missing-has-one: exploit tx should have been rejected — admin/maker/owner did not sign / has_one missing / seeds invalid / owner check absent. See programs/rewards_pool/src/lib.rs — SetEmissions context lacks `has_one = admin` allowing any signer to change pool emissions.

#[test]
pub fn test_sol2_missing_has_one_litesvm() {
    let program_id: Pubkey = "3CqqMHfeVDdXsaHcyJqfFPB8R2F8q5gVaXrHxx4JpnoK"
        .parse()
        .unwrap();

    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/rewards_pool.so",
    )
    .expect("SETUP FAILED: could not read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    // Admin keypair - the legitimate pool creator
    let admin = Keypair::new();
        // …setup truncated for brevity…

    // Post-patch invariant: a non-admin caller should NOT be able to set emissions.
    // On the buggy code, this tx succeeds (result.is_ok()), so the assertion fails → bug fires.
    // On the patched code (with has_one = admin on SetEmissions), this tx is rejected → assertion holds.
    assert!(
        result.is_err(),
        "SOL2-missing-has-one: exploit tx should have been rejected — admin/maker/owner did not \
        sign / has_one missing / seeds invalid / owner check absent. \
        See programs/rewards_pool/src/lib.rs — SetEmissions context lacks `has_one = admin` \
        allowing any signer to change pool emissions."
    );
}

--- a/programs/rewards_pool/src/lib.rs
+++ b/programs/rewards_pool/src/lib.rs
@@ -201,11 +202,11 @@
     pub pool: Account<'info, Pool>,
     #[account(mut)]
     pub farm: Account<'info, Farm>,
-    #[account(mut)]
+    #[account(mut, has_one = owner @ RewardsError::BadConfig)]
     pub stake_position: Account<'info, StakePosition>,
-    #[account(mut)]
+    #[account(mut, has_one = owner @ RewardsError::BadConfig)]
     pub user_state: Account<'info, UserState>,
-    pub claimer: Signer<'info>,
+    pub owner: Signer<'info>,
 }
 
 #[derive(Accounts)]
@@ -214,31 +215,32 @@
     pub pool: Account<'info, Pool>,
     #[account(mut)]
     pub farm: Account<'info, Farm>,
-    #[account(mut)]
+    #[account(mut, has_one = owner @ RewardsError::BadConfig)]
     pub stake_position: Account<'info, StakePosition>,
     pub owner: Signer<'info>,
 }
 
 #[derive(Accounts)]
 pub struct Compound<'info> {
+    #[account(mut)]
     pub pool: Account<'info, Pool>,
     #[account(mut)]
     pub farm: Account<'info, Farm>,
-    #[account(mut)]
+    #[account(mut, has_one = owner @ RewardsError::BadConfig)]
     pub stake_position: Account<'info, StakePosition>,
-    pub caller: Signer<'info>,
+    pub owner: Signer<'info>,
 }
 
 #[derive(Accounts)]
 pub struct SetEmissions<'info> {
-    #[account(mut)]
+    #[account(mut, has_one = admin @ RewardsError::BadConfig)]
     pub pool: Account<'info, Pool>,
-    pub caller: Signer<'info>,
+    pub admin: Signer<'info>,
 }
 
 #[derive(Accounts)]
 pub struct CloseFarm<'info> {
-    #[account(mut)]
+    #[account(mut, has_one = admin @ RewardsError::BadConfig)]
     pub pool: Account<'info, Pool>,
     #[account(mut)]
     pub farm: Account<'info, Farm>,

SOL6-admin-check-from-instruction-data: exploit tx should have been rejected — pause_feed has no admin/has_one check; any arbitrary signer can pause any feed without being the board admin. See programs/oracle_board/src/lib.rs (PauseFeed struct, ~line 132).

#[test]
pub fn test_sol6_admin_check_from_instruction_data_litesvm() {
    let program_id = "DDrZpEeyhZq4ukz5WhGFdtn5PP1DfMmuFNBBCr8UBY6W"
        .parse::<Pubkey>()
        .unwrap();

    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/oracle_board.so",
    )
    .expect("failed to read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    // --- Keypairs ---
    let real_admin = Keypair::new();
        // …setup truncated for brevity…
    let blockhash = svm.latest_blockhash();
    let pause_msg = Message::new(&[pause_ix], Some(&attacker.pubkey()));
    let pause_tx = Transaction::new(&[&attacker], pause_msg, blockhash);
    let exploit_result = svm.send_transaction(pause_tx);

    assert!(
        exploit_result.is_err(),
        "SOL6-admin-check-from-instruction-data: exploit tx should have been rejected — \
        pause_feed has no admin/has_one check; any arbitrary signer can pause any feed \
        without being the board admin. See programs/oracle_board/src/lib.rs (PauseFeed struct, ~line 132)."
    );
}

--- a/programs/oracle_board/src/lib.rs
+++ b/programs/oracle_board/src/lib.rs
@@ -107,6 +116,11 @@
     }
 
     pub fn rotate_publisher(ctx: Context<RotatePublisher>, new_authority: Pubkey) -> Result<()> {
+        require_keys_eq!(
+            ctx.accounts.caller.key(),
+            ctx.accounts.publisher.authority,
+            OracleError::BadConfig
+        );
         ctx.accounts.publisher.authority = new_authority;
         ctx.accounts.publisher.last_slot = 0;
         Ok(())
@@ -175,9 +189,11 @@
 
 #[derive(Accounts)]
 pub struct PauseFeed<'info> {
-    #[account(mut)]
+    #[account(has_one = admin)]
+    pub board: Account<'info, Board>,
+    #[account(mut, has_one = board @ OracleError::BadConfig)]
     pub feed: Account<'info, Feed>,
-    pub caller: Signer<'info>,
+    pub admin: Signer<'info>,
 }
 
 #[derive(Accounts)]

SOL11-pda-seeds-attacker-controlled: exploit tx should have been rejected — the proposal index seed is fully attacker-controlled (index=9999 != proposal_count=0), allowing arbitrary PDA collisions/skips. A patched program must validate index == realm.proposal_count before accepting the seed. See programs/governance_hub/src/lib.rs create_proposal / CreateProposal constraint.

#[test]
pub fn test_sol11_pda_seeds_attacker_controlled_litesvm() {
    let program_id = "GUkBs3SKV78NepLMueWvkEjohsfcHA6DNd4VbWRL4yXV"
        .parse::<Pubkey>()
        .unwrap();

    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/governance_hub.so",
    )
    .expect("failed to read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    // Admin keypair
    let admin = Keypair::new();
        // …setup truncated for brevity…
    // On the buggy code, this succeeds (result.is_ok()), so the assertion
    // below FAILS, firing the bug. On patched code, the tx is rejected and
    // the assertion holds.
    assert!(
        exploit_result.is_err(),
        "SOL11-pda-seeds-attacker-controlled: exploit tx should have been rejected — \
        the proposal index seed is fully attacker-controlled (index=9999 != proposal_count=0), \
        allowing arbitrary PDA collisions/skips. A patched program must validate \
        index == realm.proposal_count before accepting the seed. \
        See programs/governance_hub/src/lib.rs create_proposal / CreateProposal constraint."
    );
}

--- a/programs/governance_hub/src/lib.rs
+++ b/programs/governance_hub/src/lib.rs
@@ -46,6 +46,9 @@
         if true == realm_state.paused {
             return err!(GovernanceError::Paused);
         }
+        if index != realm_state.proposal_count {
+            return err!(GovernanceError::BadConfig);
+        }
         let proposal_state = &mut ctx.accounts.proposal;
         proposal_state.realm = realm_state.key();
         proposal_state.index = index;

SOL13-saturating-sub-on-security: total_cash was silently drained by saturating_sub in seize_reserves — observed total_cash=0, expected 9000 (total_reserves=0 was seized but total_cash should be untouched). See programs/credit_market/src/lib.rs seize_reserves: `market_state.total_cash = market_state.total_cash.saturating_sub(amount)`

#[test]
pub fn test_sol13_saturating_sub_on_security_litesvm() {
    let program_id = "9fTa2LCqFqAtKQvuWnM2eZKkNqeYUcKUiSmAgJqco7qD".parse::<Pubkey>().unwrap();
    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/credit_market.so"
    ).expect("failed to read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    let admin = Keypair::new();
    let borrower = Keypair::new();
    let crank = Keypair::new();

    svm.airdrop(&admin.pubkey(), 100_000_000_000).unwrap();
    svm.airdrop(&borrower.pubkey(), 100_000_000_000).unwrap();
        // …setup truncated for brevity…
    // total_cash should remain 9000 after seizing reserves.
    // On buggy code: total_cash = 9000.saturating_sub(110_010) = 0 → assertion fails → bug fires.
    // On patched code: total_cash = 9000 → assertion holds.
    assert!(
        total_cash == 9000,
        "SOL13-saturating-sub-on-security: total_cash was silently drained by saturating_sub in seize_reserves \
        — observed total_cash={}, expected 9000 (total_reserves={} was seized but total_cash should be untouched). \
        See programs/credit_market/src/lib.rs seize_reserves: `market_state.total_cash = market_state.total_cash.saturating_sub(amount)`",
        total_cash,
        total_reserves,
    );
}

--- a/programs/credit_market/src/lib.rs
+++ b/programs/credit_market/src/lib.rs
@@ -116,7 +119,7 @@
         let borrower_account = &mut ctx.accounts.obligation;
         let repayment_value = borrower_account.borrow_value.min(amount);
         borrower_account.borrow_value = borrower_account.borrow_value.checked_sub(repayment_value).ok_or(CreditError::Overflow)?;
-        borrower_account.debt_units = borrower_account.debt_units.saturating_sub(repayment_value);
+        borrower_account.debt_units = borrower_account.debt_units.checked_sub(repayment_value).ok_or(CreditError::Overflow)?;
         market_state.total_cash = repayment_value.checked_add(market_state.total_cash).ok_or(CreditError::Overflow)?;
         market_state.total_borrows = market_state.total_borrows.checked_sub(repayment_value).ok_or(CreditError::Overflow)?;
         Ok(())
@@ -138,12 +144,12 @@
             .checked_mul(ctx.accounts.listing.liquidation_bonus_bps as u64 + 10_000)
             .ok_or(CreditError::Overflow)?
             / 10_000;
-        let collateral_to_seize = liquidation_value / 1.max(collateral_price);
+        let collateral_to_seize = liquidation_value / collateral_price;
 
         borrower_account.borrow_value = borrower_account.borrow_value.checked_sub(applied_repay).ok_or(CreditError::Overflow)?;
-        borrower_account.debt_units = borrower_account.debt_units.saturating_sub(applied_repay);
-        borrower_account.collateral_units = borrower_account.collateral_units.saturating_sub(collateral_to_seize);
-        borrower_account.collateral_value = borrower_account.collateral_value.saturating_sub(liquidation_value);
+        borrower_account.debt_units = borrower_account.debt_units.checked_sub(applied_repay).ok_or(CreditError::Overflow)?;
+        borrower_account.collateral_units = borrower_account.collateral_units.checked_sub(collateral_to_seize).ok_or(CreditError::Overflow)?;
+        borrower_account.collateral_value = borrower_account.collateral_value.checked_sub(liquidation_value).ok_or(CreditError::Overflow)?;
         market_state.total_cash = applied_repay.checked_add(market_state.total_cash).ok_or(CreditError::Overflow)?;
         market_state.total_borrows = market_state.total_borrows.checked_sub(applied_repay).ok_or(CreditError::Overflow)?;
         Ok(())
@@ -168,7 +174,6 @@
             return err!(CreditError::BadAmount);
         }
         market_state.total_reserves = market_state.total_reserves.checked_sub(amount).ok_or(CreditError::Overflow)?;
-        market_state.total_cash = market_state.total_cash.saturating_sub(amount);
         Ok(())
     }
 }

SOL3-missing-seeds-bump: exploit tx should have been rejected — the Borrow context has no seeds or has_one constraint on obligation, allowing any signer to borrow against any obligation account. See programs/credit_market/src/lib.rs Borrow struct (missing seeds/has_one on obligation).

#[test]
pub fn test_sol3_missing_seeds_bump_litesvm() {
    let program_id = "9fTa2LCqFqAtKQvuWnM2eZKkNqeYUcKUiSmAgJqco7qD".parse::<Pubkey>().unwrap();
    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/credit_market.so"
    ).expect("SETUP FAILED: could not read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    let admin = Keypair::new();
    let oracle_board = Keypair::new();
    let borrower = Keypair::new();
    let supplier = Keypair::new();
    let attacker = Keypair::new();
    let mint = Keypair::new();
        // …setup truncated for brevity…
        // be rejected because obligation.owner != attacker.pubkey() or the PDA
        // seeds won't match the attacker's key.
        // On the BUGGY code: result.is_ok() → assertion fails → bug fires.
        // On the PATCHED code: result.is_err() → assertion holds → no bug.
        assert!(
            result.is_err(),
            "SOL3-missing-seeds-bump: exploit tx should have been rejected — \
            the Borrow context has no seeds or has_one constraint on obligation, \
            allowing any signer to borrow against any obligation account. \
            See programs/credit_market/src/lib.rs Borrow struct (missing seeds/has_one on obligation)."
        );
    }

--- a/programs/credit_market/src/lib.rs
+++ b/programs/credit_market/src/lib.rs
@@ -223,8 +228,9 @@
 #[derive(Accounts)]
 pub struct DepositCollateral<'info> {
     pub market: Account<'info, Market>,
+    #[account(seeds = [b"listing", market.key().as_ref(), listing.mint.as_ref()], bump = listing.bump)]
     pub listing: Account<'info, CollateralListing>,
-    #[account(mut)]
+    #[account(mut, seeds = [b"obligation", market.key().as_ref(), owner.key().as_ref()], bump = obligation.bump)]
     pub obligation: Account<'info, Obligation>,
     pub owner: Signer<'info>,
 }
@@ -233,9 +239,9 @@
 pub struct Borrow<'info> {
     #[account(mut)]
     pub market: Account<'info, Market>,
-    #[account(mut)]
+    #[account(mut, seeds = [b"obligation", market.key().as_ref(), owner.key().as_ref()], bump = obligation.bump, has_one = owner @ CreditError::BadConfig)]
     pub obligation: Account<'info, Obligation>,
-    pub borrower: Signer<'info>,
+    pub owner: Signer<'info>,
 }
 
 #[derive(Accounts)]

SOL39-time-lock-set-never-checked: exploit tx should have been rejected — unstake() never checks position.unlock_slot against current slot, allowing immediate withdrawal despite lock_slots=1000. See programs/rewards_pool/src/lib.rs unstake() fn (missing require!(Clock::get()?.slot >= position.unlock_slot)).

#[test]
pub fn test_sol39_time_lock_set_never_checked_litesvm() {
    let program_id = "3CqqMHfeVDdXsaHcyJqfFPB8R2F8q5gVaXrHxx4JpnoK"
        .parse::<Pubkey>()
        .unwrap();

    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/rewards_pool.so",
    )
    .expect("SETUP FAILED: could not read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    let admin = Keypair::new();
    let user = Keypair::new();
        // …setup truncated for brevity…
    // Post-patch invariant: the unstake MUST be rejected because the time-lock
    // has not expired (unlock_slot = stake_slot + 1000, current_slot << that).
    // On buggy code: unstake_result.is_ok() => assertion fails => bug fires.
    // On patched code: unstake_result.is_err() => assertion holds => bug fixed.
    assert!(
        unstake_result.is_err(),
        "SOL39-time-lock-set-never-checked: exploit tx should have been rejected — \
        unstake() never checks position.unlock_slot against current slot, \
        allowing immediate withdrawal despite lock_slots=1000. \
        See programs/rewards_pool/src/lib.rs unstake() fn (missing require!(Clock::get()?.slot >= position.unlock_slot))."
    );
}

--- a/programs/rewards_pool/src/lib.rs
+++ b/programs/rewards_pool/src/lib.rs
@@ -85,6 +85,7 @@
     pub fn unstake(ctx: Context<Unstake>, amount: u64) -> Result<()> {
         require!(0 < amount, RewardsError::BadAmount);
         let position = &mut ctx.accounts.stake_position;
+        require!(Clock::get()?.slot >= position.unlock_slot, RewardsError::BadAmount);
         let farm_account = &mut ctx.accounts.farm;
         require!(amount <= position.amount, RewardsError::BadAmount);
 

SOL43-aggregate-input-range-bypass: exploit tx should have been rejected — aggregate() validates only the average of inputs but not each individual input, allowing answer_a=-1000000 and answer_b=1000150 (both outside [min=100, max=200]) to pass through as long as their average (100) is in range. See programs/oracle_board/src/lib.rs aggregate() function, individual-input range check absent.

#[test]
pub fn test_sol43_aggregate_input_range_bypass_litesvm() {
    let program_id = "DDrZpEeyhZq4ukz5WhGFdtn5PP1DfMmuFNBBCr8UBY6W".parse::<Pubkey>().unwrap();
    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/oracle_board.so"
    ).expect("failed to read .so file");

    let mut svm = LiteSVM::new();
    svm.add_program(program_id, &so_bytes);

    let admin = Keypair::new();
    let crank = Keypair::new();

    svm.airdrop(&admin.pubkey(), 100_000_000_000).unwrap();
    svm.airdrop(&crank.pubkey(), 100_000_000_000).unwrap();

        // …setup truncated for brevity…
    // falls within the range. The patched code would return an error here.
    // On the current buggy code, agg_result is Ok (bug fires: assertion fails).
    // On patched code, agg_result is Err (assertion holds).
    assert!(
        agg_result.is_err(),
        "SOL43-aggregate-input-range-bypass: exploit tx should have been rejected — \
        aggregate() validates only the average of inputs but not each individual input, \
        allowing answer_a=-1000000 and answer_b=1000150 (both outside [min=100, max=200]) \
        to pass through as long as their average (100) is in range. \
        See programs/oracle_board/src/lib.rs aggregate() function, individual-input range check absent."
    );
}

--- a/programs/oracle_board/src/lib.rs
+++ b/programs/oracle_board/src/lib.rs
@@ -82,6 +82,15 @@
         if feed_state.paused {
             return err!(OracleError::Paused);
         }
+        if feed_state.min_answer > answer_a || feed_state.max_answer < answer_a {
+            return err!(OracleError::BadAnswer);
+        }
+        if feed_state.min_answer > answer_b || feed_state.max_answer < answer_b {
+            return err!(OracleError::BadAnswer);
+        }
+        if feed_state.min_answer > answer_c || feed_state.max_answer < answer_c {
+            return err!(OracleError::BadAnswer);
+        }
         let combined_answer = (answer_a.checked_add(answer_b).ok_or(OracleError::Overflow)?).checked_add(answer_c).ok_or(OracleError::Overflow)?;
         let averaged_answer = combined_answer / (3);
         if feed_state.min_answer > averaged_answer || feed_state.max_answer < averaged_answer {

SOL27-oracle-zero-price: deposit_collateral accepted reported_price=0, crediting zero collateral value while incrementing collateral_units — attacker can inflate unit count with worthless deposits. See programs/credit_market/src/lib.rs deposit_collateral handler (reported_price parameter accepted without oracle validation or zero-price rejection).

#[test]
pub fn test_sol27_oracle_zero_price_litesvm() {
    let program_id: Pubkey = "9fTa2LCqFqAtKQvuWnM2eZKkNqeYUcKUiSmAgJqco7qD".parse().unwrap();

    let mut svm = LiteSVM::new();
    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/credit_market.so"
    ).expect("failed to read .so");
    svm.add_program(program_id, &so_bytes);

    let admin = Keypair::new();
    let borrower = Keypair::new();
    let supplier = Keypair::new();

    svm.airdrop(&admin.pubkey(), 100_000_000_000).unwrap();
    svm.airdrop(&borrower.pubkey(), 100_000_000_000).unwrap();
        // …setup truncated for brevity…
        );
        svm.send_transaction(tx)
    };

    // Post-patch invariant: deposit_collateral with price=0 must be rejected.
    // On buggy code: exploit_res.is_ok() → assertion fails → bug fires.
    // On patched code: exploit_res.is_err() → assertion holds → bug fixed.
    assert!(
        exploit_res.is_err(),
        "SOL27-oracle-zero-price: deposit_collateral accepted reported_price=0, crediting zero collateral value while incrementing collateral_units — attacker can inflate unit count with worthless deposits. See programs/credit_market/src/lib.rs deposit_collateral handler (reported_price parameter accepted without oracle validation or zero-price rejection)."
    );
}

--- a/programs/credit_market/src/lib.rs
+++ b/programs/credit_market/src/lib.rs
@@ -75,6 +75,9 @@
         if 0 == units {
             return err!(CreditError::BadAmount);
         }
+        if 0 == reported_price {
+            return err!(CreditError::BadAmount);
+        }
         if !(ctx.accounts.listing.enabled) {
             return err!(CreditError::Disabled);
         }
@@ -126,6 +129,9 @@
         if 0 == repay_amount {
             return err!(CreditError::BadAmount);
         }
+        if 0 == collateral_price {
+            return err!(CreditError::BadAmount);
+        }
         let market_state = &mut ctx.accounts.market;
         let borrower_account = &mut ctx.accounts.obligation;
         if borrower_account.collateral_value >= borrower_account.borrow_value {

SOL40-inverted-bounds-comparator: initialize_pool with max_multiplier_bps=5000 (valid 50%) was rejected — the comparator `require!(10_000 <= max_multiplier_bps)` is inverted; it should be `require!(10_000 >= max_multiplier_bps)` to allow values <= 10_000. See src/lib.rs line 10 (initialize_pool).

#[test]
pub fn test_sol40_inverted_bounds_comparator_litesvm() {
    let mut svm = LiteSVM::new();

    let so_bytes = std::fs::read(
        "/root/audit_runs/ottersec-eval/workspaces/solana-medium/hunts/20260516-030436/build/target/deploy/rewards_pool.so",
    )
    .expect("Failed to read .so file");

    let program_id: Pubkey = "3CqqMHfeVDdXsaHcyJqfFPB8R2F8q5gVaXrHxx4JpnoK"
        .parse()
        .unwrap();

    svm.add_program(program_id, &so_bytes);

    let admin = Keypair::new();
        // …setup truncated for brevity…
    //   require!(10_000 >= max_multiplier_bps, ...) to accept values <= 10_000
    // On buggy code: exploit_result.is_err() (BadConfig), so assertion FAILS → bug fires.
    // On patched code: exploit_result.is_ok(), so assertion holds → bug fixed.
    assert!(
        exploit_result.is_ok(),
        "SOL40-inverted-bounds-comparator: initialize_pool with max_multiplier_bps=5000 (valid 50%) \
        was rejected — the comparator `require!(10_000 <= max_multiplier_bps)` is inverted; \
        it should be `require!(10_000 >= max_multiplier_bps)` to allow values <= 10_000. \
        See src/lib.rs line 10 (initialize_pool). Error: {:?}",
        exploit_result.err()
    );
}

--- a/programs/rewards_pool/src/lib.rs
+++ b/programs/rewards_pool/src/lib.rs
@@ -7,7 +7,7 @@
     use super::*;
 
     pub fn initialize_pool(ctx: Context<InitializePool>, emissions_per_slot: u64, max_multiplier_bps: u16) -> Result<()> {
-        require!(10_000 <= max_multiplier_bps, RewardsError::BadConfig);
+        require!(max_multiplier_bps <= 10_000, RewardsError::BadConfig);
         let pool_account = &mut ctx.accounts.pool;
         pool_account.admin = ctx.accounts.admin.key();
         pool_account.reward_mint = ctx.accounts.reward_mint.key();

03 — Fix-bundle activity

Per-finding fix-bundle pipeline state. Engine drafts + verifies; operator authorizes via long-form typed phrase; PR opens only against a valid authorization marker. The table includes bundles for confirmed findings AND for triaged duplicates / SOFT / FALSE fires — the latter are retained as audit-trail evidence of every PoC the hunt loop landed against the target, NOT as published findings (see Layer 2.5 gating in §B).

A — Severity rubric

B — Methodology

Layer overview

Cycle execution

This cycle was produced by Jelleo's continuous, hypothesis-driven Solana audit loop. Every finding originates as a falsifiable invariant claim from a per-protocol hypothesis library, dispatched to Layer 1 multi-agent recon, promoted on contested verdicts via Layer 1.5 adversarial debate, and confirmed empirically through a Layer 2 cargo test proof-of-concept. Layer 2.5 triage classifies each fire as STRONG / SOFT / FALSE / LOST; only STRONG cluster representatives advance to confirmed and appear in §01 above. SOFT and STRONG duplicates land in triaged; FALSE fires return to new. Lifecycle: new → triaged → confirmed → disclosed → fixed → verified. Every cycle is signed Ed25519 against the platform key — see the cover-page receipt.

Non-fire accounting17 hypotheses tested but PoC did not fire — 17× rejected. These are hypotheses where Layer 1 / Layer 1.5 returned a verdict but the Layer 2 PoC author either declined to produce a test (no plausible attack) or the test ran without an abort in the target module.

Cycle wall-clock68m 6s

§ B.1 — Cycle funnel. Hypotheses tested → PoC fires → Layer 2.5 judge filters out artifactual / mis-invariant fires → surviving STRONG fires cluster by code site → cluster representatives become published findings.

C — Audit artifacts

All cycle artifacts are persisted on disk and verifiable independently of this report. The table below lists the canonical paths under the cycle workspace so a reviewer can re-execute every layer or recompute the cycle Merkle root.

D — Disclaimers

Findings in this report reflect the state of the engine source at the commit hash on the cover page. Subsequent changes to the codebase are not analyzed. The report is not a guarantee of code correctness or security: it documents invariants that fired (or held) under the hypothesis library applied during this cycle. Out-of-scope items are listed in §00.1 (Scope). Findings flagged by Layer 2.5 as SOFT / FALSE / LOST are retained in the audit trail (§03) but are not published findings; readers should not interpret a bundle in §03 as a confirmed vulnerability unless its finding row is also present in §01.

Communication channel: security@jelleo.com (PGP key on jelleo.com/security.html). Coordinated disclosure follows the timeline published in our security policy; pre-disclosure leak protections are enforced at the report level (the --public renderer suppresses confirmed-but-not-disclosed findings).

Methodology spec: docs/methodology/ · Live reference: jelleo.com/methodology.html · Source: github.com/Copenhagen0x/audit-pipeline-cli