OgLong

QuillAuditsFiles named in the report

Audit · firm’s term: audit report

QuillAudits reviewed OGLONG on 20 Jul 2024: 6 findings, 0 critical; 5 marked fixed, 1 open.

No open critical findings
Open the reportOpen OGLONG’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium000
Low104
HighImproper Token Validation in Burn FunctionFixed

The current implementation of the Burn function does not validate if the user is attempting to burn the correct token. This flaw allows users to burn any token, including valueless ones, which is then accounted for by the off-chain logic. Consequently, this can lead to significant financial loss as users could receive tokens on the other side of the bridge without burning the correct tokens.

LowInsufficient Validation in SetOwner FunctionFixed

The SetOwner function currently lacks proper validation to ensure that the new owner is the same as the og_mint authority. Without this validation, it is possible to set an inappropriate owner, which could break the program and disrupt its intended operations.

LowMissing Event Emission for Critical ActionsFixed

Critical actions such as initialization and setting the owner do not emit events. The absence of events for these actions can lead to difficulties in tracking and auditing these operations off-chain, reducing transparency and traceability.

LowUse of Developer's Own Wallet in Anchor.tomlFixed

The Anchor.toml configuration file points to the developer's own wallet, which prevents others from running tests without modifying this file. This practice hinders collaboration and makes automated testing setups more difficult.

LowUse of msg! Instead of Solana Anchor EventsFixed

The current implementation uses msg! for logging and passing transaction strings to the mint and burn functions. This approach is not CU (Gas) optimized and is not optimal for tracking and deserializing events, which can complicate off-chain indexing and monitoring.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • programs/oglong-bridge/src/lib.rs

Part of OGLONG’s security record

OGLONG
Audits1 audit by 1 firmLast audit Jul 2024, by QuillAudits.
Critical findingsNo open critical findingsIn 1 report.
Open OGLONG’s security record

Security firm

QuillAudits

350 projects reviewed · 459 reports · latest Apr 2025

See QuillAudits’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us