Audit · firm’s term: audit report
QuillAudits reviewed OGLONG on 20 Jul 2024: 6 findings, 0 critical; 5 marked fixed, 1 open.
Report hosted on quillaudits.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 4 |
The current implementation of the Burn function does not validate if the user is attempting to burn the correct token. This flaw allows users to burn any token, including valueless ones, which is then accounted for by the off-chain logic. Consequently, this can lead to significant financial loss as users could receive tokens on the other side of the bridge without burning the correct tokens.
The SetOwner function currently lacks proper validation to ensure that the new owner is the same as the og_mint authority. Without this validation, it is possible to set an inappropriate owner, which could break the program and disrupt its intended operations.
Critical actions such as initialization and setting the owner do not emit events. The absence of events for these actions can lead to difficulties in tracking and auditing these operations off-chain, reducing transparency and traceability.
The Anchor.toml configuration file points to the developer's own wallet, which prevents others from running tests without modifying this file. This practice hinders collaboration and makes automated testing setups more difficult.
The current implementation uses msg! for logging and passing transaction strings to the mint and burn functions. This approach is not CU (Gas) optimized and is not optimal for tracking and deserializing events, which can complicate off-chain indexing and monitoring.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (1)
350 projects reviewed · 459 reports · latest Apr 2025
See QuillAudits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us