Solana Agg Settlement Program - 0x Project

1. Introduction

ZeroEx engaged Halborn to conduct a security assessment on sol-settler program beginning on March 24th, 2025 and ending on March 28th, 2025. The security assessment was scoped to the smart contracts provided in the GitHub repository sol-settler, commit hashes and further details can be found in the Scope section of this report.

The ZeroEx team is releasing the sol-settler program, an onchain settlement program to support swap routes from an offchain aggregation service.

During the security assessment a new action was added, pumpswap_buy, which allows users to trade tokens directly from liquidity pools without intermediaries through Pump Swap, a decentralized exchange which relies on an automated market maker (AMM) system.

2. Assessment Summary

Halborn was provided 5 days for the engagement and assigned one full-time security engineer to review the security of the Solana Programs in scope. The engineer is a blockchain and smart contract security expert with advanced smart contract hacking skills, and deep knowledge of multiple blockchain protocols.

The purpose of the assessment is to:

• Identify potential security issues within the Solana Program.

• Ensure that smart contract functionality operates as intended.

In summary, Halborn did not identify any significant security risks. However, some improvements were highlighted that were addressed by the ZeroEx team. The main ones were the following:

• Add a check to ensure the provided wsol_mint_account corresponds to the native SOL mint.

• Validate that amount_in is not lower than the actual balance of the sell account before processing any actions.

• Replace expect() with structured error-handling mechanisms.

3. Test Approach and Methodology

Halborn performed a combination of a manual review of the source code and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of the program assessment. While manual testing is recommended to uncover flaws in business logic, processes, and implementation; automated testing techniques help enhance coverage of programs and can quickly identify items that do not follow security best practices.

The following phases and associated tools were used throughout the term of the assessment:

• Research into the architecture, purpose, and use of the platform.

• Manual program source code review to identify business logic issues.

• Mapping out possible attack vectors

• Thorough assessment of safety and usage of critical Rust variables and functions in scope that could lead to arithmetic vulnerabilities.

• Scanning dependencies for known vulnerabilities (cargo audit).

• Local runtime testing (cargo test)