Endogenous AVS - Solayer

1. Introduction

Solayer team engaged Halborn to conduct a security assessment on their Endogenous AVS Solana program beginning on July 30th, 2024, and ending on August, 5th, 2024. The security assessment was scoped to the Solana Program provided in endoavs-program GitHub repository. Commit hashes and further details can be found in the Scope section of this report.

The Endogenous AVS program takes the sSOL liquid mint and transforms it into a synthetic asset representing the delegation to a particular project, using the delegate instruction. These mints can be undelegated instantly if there is a need for trade, through the undelegate instruction.

Partners will be able to create an endoavs account through the create instruction, passing a mint address which they can customize. The authority can customize the AVS token name, symbol, uri/url and metadata of these assets through instructions. The authority can also transfer the authority to other account, which is irrevocable.

These assets use the same liquidity as the underlying sSOL. Ultimately, the goal is to enable Solayer to provide stake-weighted quality of service to the AVS.

2. Assessment Summary

Halborn was provided 6 days for the engagement and assigned one full-time security engineer to review the security of the Solana Program in scope. The engineer is a blockchain and smart contract security expert with advanced smart contract hacking skills, and deep knowledge of multiple blockchain protocols.

The purpose of the assessment is to:

• Identify potential security issues within the Endogenous AVS Solana Program.

• Ensure that the program's functionality operates as intended.

In summary, Halborn identified some low-severity and informational security issues, that were addressed and acknowledged by the Solayer team. The main ones were the following:

• System Flooding and Spamming.

• Lack of two-step authority transfer.

• Decimals should be enforced.

• Missing URI and URL prefix validation.

• Missing Metadata size validation.

• Missing Event emissions.

• Outdated dependencies.

Overall, the program in-scope is adherent to Solana's best-practices and carries consistent code quality.

3. Test Approach and Methodology

Halborn performed a combination of a manual review of the source code and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of the program assessment. While manual testing is recommended to uncover flaws in business logic, processes, and implementation; automated testing techniques help enhance coverage of programs and can quickly identify items that do not follow security best practices.

The following phases and associated tools were used throughout the term of the assessment:

• Research into the architecture, purpose, and use of the platform.

• Manual program source code review to identify business logic issues.

• Mapping out possible attack vectors.

• Thorough assessment of safety and usage of critical Rust variables and functions in scope that could lead to arithmetic vulnerabilities.

• Scanning dependencies for known vulnerabilities (cargo audit).

• Local runtime testing (anchor test).