Dr. Fraudsworth's Finance Factory

Description

The mainnet cfg block in tax-program constants.rs hardcodes the devnet treasury address (8kPzh...) for mainnet builds. The actual mainnet treasury (3ihhw...) is injected at build time by patch-mint-addresses.ts reading TREASURY_PUBKEY from env. However, the verified-build.yml CI pipeline does NOT include the patching step — meaning CI-produced verified binaries would contain the wrong treasury address. On-chain evidence confirms the deployed binary uses the correct treasury (3ihhw... has 1.78 SOL; 8kPzh... has 0 SOL), so no funds are misdirected today. But the build process that produced the deployed binary is not fully captured in the public repository, undermining independent reproducibility of OtterSec verified builds.

Location

// constants.rs line 146-148 (mainnet cfg):
#[cfg(not(any(feature = "devnet", feature = "localnet")))]
pub fn treasury_pubkey() -> Pubkey {
    Pubkey::from_str("8kPzhQoUPx7LYM18f9TzskW4ZgvGyq4jMPYZikqmHMH4").unwrap()
}

// patch-mint-addresses.ts line 201 (mainnet fallback):
treasuryAddress = process.env.TREASURY_PUBKEY || "8kPzhQoUPx7LYM18f9TzskW4ZgvGyq4jMPYZikqmHMH4";

// mainnet.json line 72 (actual treasury):
"treasury": "3ihhwLnEJ2duwPSLYxhLbFrdhhxXLcvcrV9rAHqMgzCv"

Description

The WhitelistAuthority PDA (J3cjg...YpJe) has authority = Some(4SMcP...NAvXJ), the Squads v4 vault. The burn_authority() instruction exists but has not been called — the whitelist remains mutable. The multisig can add new WhitelistEntry PDAs, allowing any address to send/receive tokens without triggering the transfer hook's tax validation. Currently all 8 whitelisted addresses are legitimate protocol PDAs (AMM vaults, carnage vaults, staking vault, conversion vault). However, the capability to whitelist arbitrary addresses persists. Since all operations go through the Squads multisig (confirmed: SQDS4ep65T...), exploitation requires multi-party collusion.

Location

// On-chain WhitelistAuthority account data:
// Byte 8 (Option tag): 0x01 = Some (ACTIVE, not burned)
// Authority: 4SMcPtixKvjgj3U5N7C4kcnHYcySudLZfFWc523NAvXJ (Squads vault)

// burn_authority.rs — exists but not called:
pub fn handler(ctx: Context<BurnAuthority>) -> Result<()> {
    // ... burns authority, making whitelist immutable
    auth.authority = None;
}

Description

The Content Security Policy in next.config.ts sets script-src and style-src to 'self' 'unsafe-inline'. This is a known Next.js limitation — the framework's style-jsx runtime and Turbopack CSS injection require inline scripts/styles. While React's automatic JSX escaping and the absence of dangerouslySetInnerHTML significantly reduce XSS risk, unsafe-inline weakens the CSP's ability to block injected scripts. All other CSP directives are properly restrictive (connect-src allowlisted, frame-ancestors 'none', object-src 'none').

Location

// next.config.ts CSP header:
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';

Description

The Helius webhook handler at /api/webhooks/helius/route.ts skips HMAC authentication when HELIUS_WEBHOOK_SECRET is not set and the environment is not production. While intentional for local development, staging/CI deployments without the secret accept unauthenticated webhook payloads, allowing injected protocol state data into the SSE pipeline.

Location

if (!webhookSecret && isProduction) {
  return NextResponse.json({ error: "Webhook secret not configured" }, { status: 500 });
}
// Non-production: webhook secret not required — auth bypassed

Description

generate-deployment-json.ts line 189 contains a conditional that always evaluates to 'devnet': `cluster === 'mainnet' ? 'devnet' : 'devnet'`. The Anchor.toml has no [programs.mainnet] section, so both clusters read from [programs.devnet]. This works by coincidence — devnet and mainnet use the same program IDs from the same keypairs. If they ever diverged (e.g., mainnet redeploy to new address), the generator would silently produce incorrect mainnet deployment configs.

Location

// generate-deployment-json.ts line 189:
const anchorCluster = cluster === "mainnet" ? "devnet" : "devnet";
// TODO: Add [programs.mainnet] to Anchor.toml for mainnet

// Anchor.toml — no [programs.mainnet] section exists:
// [programs.devnet]   <-- used for both devnet and mainnet
// [programs.localnet] <-- localnet only