Dr. Fraudsworth's Finance Factory

The mainnet cfg block in tax-program constants.rs hardcodes the devnet treasury address (8kPzh...) for mainnet builds. The actual mainnet treasury (3ihhw...) is injected at build time by patch-mint-addresses.ts reading TREASURY_PUBKEY from env. However, the verified-build.yml CI pipeline does NOT include the patching step — meaning CI-produced verified binaries would contain the wrong treasury address. On-chain evidence confirms the deployed binary uses the correct treasury (3ihhw... has 1.78 SOL; 8kPzh... has 0 SOL), so no funds are misdirected today. But the build process that produced the deployed binary is not fully captured in the public repository, undermining independent reproducibility of OtterSec verified builds.

The WhitelistAuthority PDA (J3cjg...YpJe) has authority = Some(4SMcP...NAvXJ), the Squads v4 vault. The burn_authority() instruction exists but has not been called — the whitelist remains mutable. The multisig can add new WhitelistEntry PDAs, allowing any address to send/receive tokens without triggering the transfer hook's tax validation. Currently all 8 whitelisted addresses are legitimate protocol PDAs (AMM vaults, carnage vaults, staking vault, conversion vault). However, the capability to whitelist arbitrary addresses persists. Since all operations go through the Squads multisig (confirmed: SQDS4ep65T...), exploitation requires multi-party collusion.

The Content Security Policy in next.config.ts sets script-src and style-src to 'self' 'unsafe-inline'. This is a known Next.js limitation — the framework's style-jsx runtime and Turbopack CSS injection require inline scripts/styles. While React's automatic JSX escaping and the absence of dangerouslySetInnerHTML significantly reduce XSS risk, unsafe-inline weakens the CSP's ability to block injected scripts. All other CSP directives are properly restrictive (connect-src allowlisted, frame-ancestors 'none', object-src 'none').

The Helius webhook handler at /api/webhooks/helius/route.ts skips HMAC authentication when HELIUS_WEBHOOK_SECRET is not set and the environment is not production. While intentional for local development, staging/CI deployments without the secret accept unauthenticated webhook payloads, allowing injected protocol state data into the SSE pipeline.

generate-deployment-json.ts line 189 contains a conditional that always evaluates to 'devnet': cluster === 'mainnet' ? 'devnet' : 'devnet'. The Anchor.toml has no [programs.mainnet] section, so both clusters read from [programs.devnet]. This works by coincidence — devnet and mainnet use the same program IDs from the same keypairs. If they ever diverged (e.g., mainnet redeploy to new address), the generator would silently produce incorrect mainnet deployment configs.

All 6 active programs share upgrade authority 4SMcPtixKvjgj3U5N7C4kcnHYcySudLZfFWc523NAvXJ, confirmed on-chain as a Squads v4 vault PDA (seeds=[multisig, F7axB..., vault, 0], bump=255, program=SQDS4ep65T...). The multisig account F7axBNUgWQQ33ZYLdenCk5SV3wBrKyYz9R7MscdPJi1A is owned by the Squads v4 program. Program upgrades require multi-party approval through the Squads governance flow. This is a centralization consideration, not a vulnerability.

The Carnage atomic execution path reaches the Solana CPI depth limit: execute_carnage_atomic -> Tax::swap_exempt -> AMM::swap_sol_pool -> Token-2022::transfer_checked -> Transfer Hook. A fallback execution path (execute_carnage) exists with more lenient slippage (75% vs 85%) and executes after the lock window expires. The protocol handles this correctly with the two-path design.

The project has 4 internal audit frameworks: SOS, Bulwark, VulnHunter (all Claude/AI-generated), and BOK (legitimate Kani formal verification). SECURITY_AUDIT_SUMMARY.md explicitly states: 'This document summarizes AI-assisted internal security analysis, not a traditional paid external audit.' OtterSec badges on 6 programs are build verification (binary reproducibility), NOT security audits. No professional third-party security audit from a recognized firm exists. The README's mention of '3 comprehensive security audits' could be misread as professional audits.

Comprehensive review of all 6 active programs against the standard 16-point Solana security checklist. All checks pass: (1) Signer checks enforced via Anchor Signer type, (2) Owner checks via seeds::program constraints, (3) Overflow protection via checked arithmetic throughout, (4) PDA validation via Anchor account constraints, (5) No reinitialization vectors (initialized flags + has_one constraints), (6) Account cosplay prevented by Anchor discriminators, (7) CPI validated via seeds::program, (8) Close account handling correct (Bonding Curve rent reclaim), (9) Arithmetic safe (u128 intermediates, checked_mul/div), (10) Rent exemption handled, (11) Duplicate accounts validated, (12) PDA access controlled, (13) Flash loan resistant (dead stake + cooldown), (14) Oracle (VRF) properly validated with anti-reroll, (15) Timing uses slot-based checks (not clock), (16) Frontrunning mitigated by 50% slippage floor.

18 properties mathematically proven via Kani model checker (v0.67.0, CBMC 6.8.0): tax floor division bounds, no u128 overflow in tax/AMM/staking calculations, AMM fee never exceeds principal, zero input produces zero output, staking cumulative monotonically increasing, bonding curve price monotonicity, no panics in reward functions. Additionally 116 properties stress-tested via Proptest (10,000+ iterations each) and LiteSVM integration tests.

Playwright automated testing confirmed: zero intercepted transaction signing attempts, zero sign message attempts, zero drainer patterns detected, zero hidden iframes, zero suspicious external requests. Only external resource: Cloudflare beacon (analytics). Security headers excellent: HSTS (63M seconds, preload), X-Frame-Options DENY, X-Content-Type-Options nosniff, Permissions-Policy (camera/mic/geo disabled), restrictive CSP, Referrer-Policy strict-origin-when-cross-origin.

RPC proxy: 17-method allowlist with inline documentation, per-method rate limits (sendTransaction 10/min, simulateTransaction 20/min, general 300/min), 64KB body limit, batch rejection, 20 concurrent request cap per IP. Webhook: constant-time HMAC comparison via timingSafeEqual, 1MB payload limit, 5-minute transaction age rejection, slot-monotonic freshness checks. SSE: per-IP connection caps, 30-minute idle timeout, 15-second heartbeat. Settings: field-by-field validation with bounds checking, corrupted JSON handling.