Fragmetric Restaking Program

QuantstampFiles named in the report

Quantstamp reviewed Fragmetric Restaking Program on 1 Nov 2024: 17 findings, 0 critical; 4 marked fixed, 12 acknowledged, 1 open.

No open critical findings
Open the reportOpen Fragmetric Restaking Program’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High002
Medium111
Low0111
MediumSignature Replay Attack Allows for Increased RewardsOpen

The protocol allows users to benefit from an accrual rate based on the wallet they use to deposit. The protocol relies on the on-chain `ed25519 program` to verify signatures related to metadata that the user supplies. The metadata needs to be signed by the admin, and the user passes that signature to the `ed25519 program` by placing the instruction before the `deposit`: ``` let current_ix_index: usize = instructions::load_current_index_checked(instructions_sysvar)?.into(); let ix = instructions::load_instruction_at_checked(current_ix_index - 1, instructions_sysvar)?; require_eq!(ix.program_id, ed25519_program::ID); ``` The `ed25519 program` will verify that the admin private key signed the metadata, indicating that the metadata is safe to use. However, there is no way to cancel a valid signature, this is because the signed data only includes the wallet name and the accrual rate related to it, but no information about an expiry time: ``` pub struct DepositMetadata { pub wallet_provider: String, pub contribution_accrual_rate: u8, // 100 is 1.0 } ``` There is also no way to verify that the user used the same wallet to deposit as the one specified in the `wallet_provider` unless the verification is done through the front end. However, users can still interact with the program directly, use whatever wallet they want with valid metadata, and get the accrual rate.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • programs/restaking/src/**

Part of Fragmetric Restaking Program’s security record

Fragmetric Restaking Program
Audits3 audits by 1 firmLast audit Oct 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 3 reports.
Open Fragmetric Restaking Program’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us