Saffron security review
Audit · firm’s term: security review
Pashov Audit Group reviewed saffron.finance (Saffron security review) on 16 Mar 2026: 25 findings, 0 critical; 23 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings25
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 5 |
| Low | 0 | 2 | 16 |
Highdeposit_fixed does not validate tick range against vault's tick_lower and tick_upperFixed
The report gives no description here.
HighFixed deposit allows unauthorized premium capture and tolerance bypassFixed
The report gives no description here.
MediumAdmin closure relies on outdated depositor address in vaultFixed
The report gives no description here.
MediumEarly_withdraw_fixed incorrectly clears fixed_side_capacity and tick valueFixed
The report gives no description here.
MediumHardcoded remaining_accounts_info prevent vault fund transfersFixed
The report gives no description here.
MediumUnvalidated token mints in create_vault lead to withdrawal failureFixed
The report gives no description here.
MediumUser withdraw_variable can be called after admin_fixed_withdraw is setFixed
The report gives no description here.
LowAcceptance of unverified pools in Saffron from Whirlpool programFixed
The report gives no description here.
LowAdmin close cannot complete after early_exit_fixedFixed
The report gives no description here.
Lowadmin_close_vault does not close vault ATAs rent lockedFixed
The report gives no description here.
Show 10 more
LowClaim leaves user claim token ATA open after burn rent not returnedFixed
The report gives no description here.
LowFront-running on create_vaultFixed
The report gives no description here.
Lowinitialize_factory allows unauthorized address to gain authorityFixed
The report gives no description here.
LowMissing anchor discriminator validation on manually parsed Orca accountFixed
The report gives no description here.
LowMissing ownership verification in withdraw.rs allows unauthorized withdrawalFixed
The report gives no description here.
LowOveraccounting early-exit penalty leads to insufficient vault balanceFixed
The report gives no description here.
LowPre-vault-start fees incorrectly assigned to variable side instead of fixed sideFixed
The report gives no description here.
LowTick bounds in Saffron do not match Orca's canonical rangeFixed
The report gives no description here.
LowTruncation of remaining_premium undercharges early exit penaltyFixed
The report gives no description here.
LowUnclaimed premium lost to fixed depositor if claim is not called in timeFixed
The report gives no description here.
Show 3 more
LowVariable asset ATA created in deposit_variable instead of initialize_vaultFixed
The report gives no description here.
LowVaultState::get_state() off-by-one at end_time boundaryFixed
The report gives no description here.
LowWithdraw handlers do not check for admin- withdrawn flagsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of saffron.finance’s security record
saffron.financeSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us