Glow Margin Vaults - Blueprint Finance

Prepared by:

HALBORN

Last Updated 11/26/2025

Date of Engagement: September 29th, 2025 - October 16th, 2025

Summary

100% of all REPORTED Findings have been addressed

All findings

Critical

High

Medium

Low

Informational

1. Introduction
2. Assessment summary
3. Scope
4. Findings overview

1. Introduction

The Glow team engaged Halborn to conduct a security assessment on their Glow Vault Solana program beginning on September 29 2025, and ending on October 16, 2025. The security assessment was scoped to the Solana Programs provided in glow-v1 GitHub repository. Commit hashes and further details can be found in the Scope section of this report.

The Glow Vault program allows users to deposit funds that are then operated by designated parties to earn returns. Users deposit funds via direct deposits or margin account transfers into the vault, and are minted a vault token representing shares of the vault. The program charges management and performance fees at the time of withdrawal.

2. Assessment Summary

Halborn was provided 2.5 weeks for the engagement and assigned one full-time security engineer to review the security of the Solana Programs in scope. The engineer is a blockchain and smart contract security expert with advanced smart contract hacking skills, and deep knowledge of multiple blockchain protocols.

The purpose of the assessment is to:

Identify potential security issues within the Solana Programs.
Ensure that smart contract functionality operates as intended.

In summary, Halborn identified some opportunities to reduce the likelihood and impact of risks, and the Glow team implemented improvements to address them. The main ones were the following:

Ensure both management and performance fees accounting is correctly handled.
Ensure the performance fees are charged on actual profit at the time of withdrawal.
Validate that operators have correct permissions.

The recommendation rated as low-risk to validate potentially dangerous or incompatible Token2022 extensions has been partially addressed, with a comprehensive solution already planned by the Glow team for upcoming releases.

3. SCOPE

REPOSITORY

(a) Repository: glow-v1

(b) Assessed Commit ID: https://github.com/Blueprint-Finance/glow-v1/pull/2437/commits/afde596e321892f23f396e4887cff1c5db3b2aff

Anchor.toml
programs/margin-pool/src/instructions/withdraw.rs
programs/margin/src/adapter.rs
programs/margin/src/instructions.rs
programs/margin/src/instructions/close_account.rs
programs/margin/src/instructions/configure/configure_account_constraints.rs
programs/margin/src/instructions/configure/mod.rs
programs/margin/src/instructions/positions/transfer_deposit.rs
programs/margin/src/lib.rs
programs/margin/src/seeds.rs
programs/margin/src/state/account.rs
programs/margin/src/state/config.rs
programs/vault/Cargo.toml
programs/vault/Xargo.toml
programs/vault/src/events.rs
programs/vault/src/instructions.rs
programs/vault/src/instructions/admin/accept_account_change.rs
programs/vault/src/instructions/admin/accrue_performance_fees.rs
programs/vault/src/instructions/admin/assign_vault_operator_admin.rs
programs/vault/src/instructions/admin/configure_vault.rs
programs/vault/src/instructions/admin/create_vault.rs
programs/vault/src/instructions/admin/mod.rs
programs/vault/src/instructions/admin/propose_account_change.rs
programs/vault/src/instructions/operator/close_operator_margin_account.rs
programs/vault/src/instructions/operator/create_operator_margin_account.rs
programs/vault/src/instructions/operator/mod.rs
programs/vault/src/instructions/operator/operator_deposit_to_vault.rs
programs/vault/src/instructions/operator/operator_transfer_from_margin.rs
programs/vault/src/instructions/operator/operator_transfer_to_margin.rs
programs/vault/src/instructions/operator/operator_withdraw_from_vault.rs
programs/vault/src/instructions/user/cancel_vault_pending_withdrawal.rs
programs/vault/src/instructions/user/create_vault_pending_withdrawal.rs
programs/vault/src/instructions/user/deposit.rs
programs/vault/src/instructions/user/execute_vault_withdrawal.rs
programs/vault/src/instructions/user/initiate_withdrawal.rs
programs/vault/src/instructions/user/mod.rs
programs/vault/src/instructions/valuation/mod.rs
programs/vault/src/instructions/valuation/update_operator_margin_account_position.rs
programs/vault/src/instructions/valuation/update_operator_wallet_position.rs
programs/vault/src/instructions/valuation/update_vault_balances.rs
programs/vault/src/lib.rs
programs/vault/src/seeds.rs
programs/vault/src/state/mod.rs
programs/vault/src/state/operator.rs
programs/vault/src/state/operator_position.rs
programs/vault/src/state/pending_withdrawals.rs
programs/vault/src/state/proposal.rs
programs/vault/src/state/vault.rs
programs/vault/src/state/vault_user.rs
programs/vault/src/utils/margin_accounts.rs
programs/vault/src/utils/mod.rs
programs/vault/src/utils/tokens.rs

Anchor.toml
programs/margin-pool/src/instructions/withdraw.rs
programs/margin/src/adapter.rs

↓ Expand ↓

Out-of-Scope: Changes that are not part of the Pull Request 2437, third party dependencies and economic attacks.

Remediation Commit ID:

Out-of-Scope: New features/implementations after the remediation commit IDs.

4. Findings Overview

Security analysis	Risk level	Remediation
Incorrect fees handling	Critical	Solved - 11/07/2025
Users may pay performance fees from unrealized profits	High	Solved - 11/07/2025
Missing Token 2022 extensions validation	Low	Partially Solved - 10/22/2025
Insuffient operator permissions check	Low	Solved - 10/22/2025
Incorrect pending withdrawal shares calculation	Informational	Solved - 10/22/2025
Reliance on Manual or Off-Chain Actions	Informational	Acknowledged - 11/05/2025
Incorrect redundant position freshness validation	Informational	Solved - 11/23/2025
Missing instructions to withdraw uncollected fees	Informational	Future Release - 10/24/2025
Unnecessary Token program resolution	Informational	Solved - 11/23/2025
Passing unnecessary accounts	Informational	Solved - 10/22/2025

Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.