Nayms - OnRe Offer/Redemption Program Spec

QuantstampFiles named in the report

Quantstamp reviewed OnRe (Nayms - OnRe Offer/Redemption Program Spec) on 3 Apr 2025: 6 findings, 0 critical; 3 marked fixed, 2 acknowledged, 1 open.

No open critical findings
Open the reportOpen OnRe’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low123
LowPotential Loss of Precision when Trading From Tokens with Nine Decimals to SixAcknowledged

When calculating how many tokens the user should receive in the `calculate_buy_amount()` function, there is a potential for some small amount of precision to be lost when the sell token has more decimals than the buy token. This is important because the team has outlined their intent to use `USDC` (six decimals) in the protocol, while the `ONe` and `rONe` tokens both have nine decimals. There are two scenarios to be aware of that could cause problems: 1. The user requests to redeem an amount of `rONE` tokens with seven or more decimals. 2. The `USDC`:`ONe` ratio when calling the `take_offer_two()` function causes a normal redemption amount to lose some precision when redeeming a partial amount in `USDC`.

LowUniqueness of `offer_id` Not EnforcedAcknowledged

The protocol uses `offer_id` values as critical seed values for deriving Program Derived Addresses (PDAs) for both offer accounts and offer authorities. While the program specification implicitly assumes offer IDs are unique, there is no on-chain mechanism to enforce this uniqueness. Offer IDs can be reused after an offer is closed, which could lead to confusion in the event logs and also issues where previously opened (and then closed) PDA accounts are reopened again. An additional issue here would be if the `boss` account becomes compromised, the new malicious boss could create an offer specifying a particular token exchange rate and then front run a users attempt to fill that order to create a new order with the same `offer_id` now offering a significantly worse exchange rate to the user.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (1)

  • anchor/programs/onreapp/src/*

Part of OnRe’s security record

OnRe
Audits6 audits by 1 firmLast audit Sep 2026, by Quantstamp.
Critical findingsNo open critical findingsAcross 6 reports.
Open OnRe’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us