Nayms - OnRe Offer/Redemption Program Spec

Quantstamp3 Apr 2025Files named in the report

Quantstamp reviewed OnRe (Nayms - OnRe Offer/Redemption Program Spec) on 3 Apr 2025: 6 findings, 0 critical; 3 marked fixed, 2 acknowledged, 1 open.

No open critical findings

Open the report Open OnRe’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	1	2	3

LowLack of Error Reporting During Program InitializationFixed

The `instructions::initialize::initialize()` function does not display an error if `state.boss` is already set. Not returning an error makes it harder to detect if the state was already initialized.

LowLack of Public Key ValidationFixed

The `instructions::set_boss::set_boss()` function does not validate the `new_boss` public key value before setting it, resulting in resetting the boss account identifier to the default public key if it is sent in the transaction. Setting the default value allows another user to reinitialize the program and gain admin-level permission. Note that this is similar to the lack of zero address checks in Solidity code bases.

LowMissing Buy Token Amount ValidationFixed

The `instructions::take_offer::calculate_buy_amount()` function does not return an error if the calculated buy token amount is zero because of integer truncation (rounding). Not checking the return value may lead to unexpected behavior.