Quantstamp reviewed Fragmetric Restaking Program on 1 Nov 2024: 17 findings, 0 critical; 4 marked fixed, 12 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 1 | 1 | 1 |
| Low | 0 | 11 | 1 |
The protocol allows users to benefit from an accrual rate based on the wallet they use to deposit. The protocol relies on the on-chain `ed25519 program` to verify signatures related to metadata that the user supplies. The metadata needs to be signed by the admin, and the user passes that signature to the `ed25519 program` by placing the instruction before the `deposit`: ``` let current_ix_index: usize = instructions::load_current_index_checked(instructions_sysvar)?.into(); let ix = instructions::load_instruction_at_checked(current_ix_index - 1, instructions_sysvar)?; require_eq!(ix.program_id, ed25519_program::ID); ``` The `ed25519 program` will verify that the admin private key signed the metadata, indicating that the metadata is safe to use. However, there is no way to cancel a valid signature, this is because the signed data only includes the wallet name and the accrual rate related to it, but no information about an expiry time: ``` pub struct DepositMetadata { pub wallet_provider: String, pub contribution_accrual_rate: u8, // 100 is 1.0 } ``` There is also no way to verify that the user used the same wallet to deposit as the one specified in the `wallet_provider` unless the verification is done through the front end. However, users can still interact with the program directly, use whatever wallet they want with valid metadata, and get the accrual rate.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us