Magic Block - Delegation Program - Magic Block

The verify_state function contains placeholder logic. It literally does nothing at this stage. Leaving it unimplemented could allow invalid states or malicious updates to go undetected.

/// Verify the committed state
#[inline(always)]
pub fn verify_state(
    _authority: &AccountInfo,
    _delegation_record: &DelegationRecord,
    _commit_record: &CommitRecord,
    _commit_state_account: &AccountInfo,
) -> ProgramResult {
    // TODO: Temporary relying on the assumption than the validator fees vault exists (as it was created by the admin)
    Ok(())
}

Implement robust verification logic in verify.rs (e.g., cryptographic proof checks, signature validations, or protocol invariants). Additionally, remove the TODO placeholder once real checks are in place. Ensure the function fails if the new state data is malformed or violates any business-critical constraints.

SOLVED: The Magic Block team has solved the issue as recommended.

In init_protocol_fees_vault instruction, any user can create the fees vault if it does not exist. The code does not check for an authorized caller. This might be acceptable in the current context, but if the protocol expects only an admin or specific entity to perform initialization, additional checks are required.

pub fn process_init_protocol_fees_vault(
    _program_id: &Pubkey,
    accounts: &[AccountInfo],
    _data: &[u8],
) -> ProgramResult {
    // Load Accounts
    let [payer, protocol_fees_vault, system_program] = accounts else {
        return Err(ProgramError::NotEnoughAccountKeys);
    };

    load_signer(payer, "payer")?;
    load_program(system_program, system_program::id(), "system program")?;

    let bump_fees_vault = load_uninitialized_pda(
        protocol_fees_vault,
        fees_vault_seeds!(),
        &crate::id(),
        true,
        "fees vault",
    )?;

    // Create the fees vault account
    create_pda(
        protocol_fees_vault,
        &crate::id(),
        8,
        fees_vault_seeds!(),
        bump_fees_vault,
        system_program,
        payer,
    )?;

    Ok(())
}

It is recommended to add an authorization check so only a recognized admin or multi-signature wallet can create the protocol fees vault. If open creation is intended, document it clearly.

ACKNOWLEDGED: The Magic Block team has acknowledged this finding, adding to the documentation that init_protocol_fee_vault is safe to be executed permissionless.

The PROTOCOL_FEES_PERCENTAGE is a compile-time constant, defined in constants.rs. If the protocol needs to adjust fee rates in the future, it can’t do so without re-deploying or upgrading the program. This is fine for a static approach but can be limiting if the business logic changes. The validator_claim_fees instruction relies on this hard-coded parameter, as follows:

    // Calculate fees and remaining amount
    let protocol_fees = (amount * u64::from(PROTOCOL_FEES_PERCENTAGE)) / 100;

It is recommended to store the fee percentage in a config account that an authorized admin can update. If the protocol demands a fixed rate forever, leave it as it is, but document the immutability.

ACKNOWLEDGED: The MagicBlock team has acknowledged this finding, as per design the protocol fees should remain constant and public.

In the commit_state instruction (see instruction_builder/commit_state.rs and processor/commit_state.rs), there is a // TODO comment referencing “sufficient validator stake” or deeper validation. This indicates the program defers critical checks (e.g., verifying the data in commit_state_bytes, ensuring the lamports changes align with protocol rules, or validating off-chain proofs). Without these checks, malicious or incorrect state could be committed.

    // Copy the new state to the initialized PDA
    let mut commit_state_data = args.commit_state_account.try_borrow_mut_data()?;
    (*commit_state_data).copy_from_slice(args.commit_state_bytes);

    // TODO - Add additional validation for the commitment, e.g. sufficient validator stake

It is recommended to implement additional logic to verify any off-chain proof or stake data in commit_state_bytes.

SOLVED: The Magic Block team has solved the issue as recommended.