Glow Margin Vaults

Introduction#

The Glow team engaged Halborn to conduct a security assessment on their Glow Vault Solana program beginning on September 29 2025, and ending on October 16, 2025. The security assessment was scoped to the Solana Programs provided in glow-v1 GitHub repository. Commit hashes and further details can be found in the Scope section of this report.

The Glow Vault program allows users to deposit funds that are then operated by designated parties to earn returns. Users deposit funds via direct deposits or margin account transfers into the vault, and are minted a vault token representing shares of the vault. The program charges management and performance fees at the time of withdrawal.

Assessment Summary#

Halborn was provided 2.5 weeks for the engagement and assigned one full-time security engineer to review the security of the Solana Programs in scope. The engineer is a blockchain and smart contract security expert with advanced smart contract hacking skills, and deep knowledge of multiple blockchain protocols.

The purpose of the assessment is to:

• Identify potential security issues within the Solana Programs.

• Ensure that smart contract functionality operates as intended.

In summary, Halborn identified some opportunities to reduce the likelihood and impact of risks, and the Glow team implemented improvements to address them. The main ones were the following:

• Ensure both management and performance fees accounting is correctly handled.

• Ensure the performance fees are charged on actual profit at the time of withdrawal.

• Validate that operators have correct permissions.

The recommendation rated as low-risk to validate potentially dangerous or incompatible Token2022 extensions has been partially addressed, with a comprehensive solution already planned by the Glow team for upcoming releases.

Scope#