OnRe Solana

Quantstamp19 May 2025Files named in the report

Audit

Quantstamp reviewed OnRe (OnRe Solana) on 19 May 2025: 5 findings, 0 critical; 3 marked fixed, 2 acknowledged.

No open critical findings

Open the report Open OnRe’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	1
Medium	0	1
Low	2	1

LowInitialization Can Be FrontrunAcknowledged

The `initialize()` function can be frontrunned after the program is deployed. An attacker might create a state and set themselves as a `boss`, preventing the real admin from controlling the program.

LowLack of Slippage Protection Exposes Users to Unfavorable Execution PricesAcknowledged

The `take_offer::take_offer_*` instruction enables users to purchase `buy_tokens` by providing a `sell_token_amount`. The exchange rate is determined by the offer's `current_interval` at execution time. However, users who submit transactions near interval boundaries face a risk: if the interval changes before transaction execution, users may receive fewer `buy_tokens` than expected due to the change in price, with no mechanism to specify acceptable limits.