Endogenous AVS - Solayer

The authority of each endo_avs account is entitled to change the name and the url through the update method, as follows:

- programs/endoavs-program/src/contexts/manage.rs

impl <'info> UpdateEndoAVSInfo<'info> {
    pub fn update(&mut self, name: Option<String>, url: Option<String>) -> Result<()> {
        if let Some(name) = name {
            require!(name.len() < MAX_ENDO_AVS_NAME_LENGTH, EndoAVSError::NameTooLong);
            self.endo_avs.name = name;
        }
        if let Some(url) = url {
            require!(url.len() < MAX_ENDO_AVS_URL_LENGTH, EndoAVSError::URLTooLong);
            self.endo_avs.url = url;
        }
        Ok(())
    }

When updating the metadata, this verification is also missing.

- programs/endoavs-program/src/contexts/metadata.rs

impl<'info> AVSTokenMetadata<'info> {
    pub fn update(&mut self, name: String, symbol: String, uri: String) -> Result<()> {
        if !symbol.ends_with(REQUIRED_TOKEN_SYMBOL_SUFFIX) {
            return Err(EndoAVSError::InvalidTokenSymbol.into());
        }

        let token_metadata = DataV2 {
            name,
            symbol,
            uri,
            seller_fee_basis_points: 0,
            creators: None,
            collection: None,
            uses: None,
        };

        let bump = [self.endo_avs.bump];
        let signer_seeds: [&[&[u8]]; 1] = [&[
            b"endo_avs",
            self.avs_token_mint.to_account_info().key.as_ref(),
            &bump,
        ][..]];

        let metadata_ctx = CpiContext::new_with_signer(
            self.token_metadata_program.to_account_info(),
            anchor_spl::metadata::UpdateMetadataAccountsV2 {
                metadata: self.avs_token_metadata.to_account_info(),
                update_authority: self.endo_avs.to_account_info(),
            },
            &signer_seeds,
        );

        anchor_spl::metadata::update_metadata_accounts_v2(
            metadata_ctx,
            None,
            token_metadata.into(),
            None,
            None,
        )?;

        Ok(())
    }
}

There are no verifications in place whether the provided url or uri starts with an expected format, such as https://, what could lead to unintended behavior in off-chain premises and also pollute the account with inaccurate information.

It is recommended to add simple verifications to check whether the provided uri and url prefixes matches pre-determined formats.

Remediation Plan

RISK ACCEPTED: The Solayer team has accepted the risk related to this finding.

The authority account of each endo_avs is entitled to update its metadata information, including name, symbol and uri, as strings. However, there are no verifications in place to prevent those user-provided inputs from being excessively large.

- programs/endoavs-program/src/contexts/metadata.rs

impl<'info> AVSTokenMetadata<'info> {
    pub fn update(&mut self, name: String, symbol: String, uri: String) -> Result<()> {
        if !symbol.ends_with(REQUIRED_TOKEN_SYMBOL_SUFFIX) {
            return Err(EndoAVSError::InvalidTokenSymbol.into());
        }

        let token_metadata = DataV2 {
            name,
            symbol,
            uri,
            seller_fee_basis_points: 0,
            creators: None,
            collection: None,
            uses: None,
        };

        let bump = [self.endo_avs.bump];
        let signer_seeds: [&[&[u8]]; 1] = [&[
            b"endo_avs",
            self.avs_token_mint.to_account_info().key.as_ref(),
            &bump,
        ][..]];

        let metadata_ctx = CpiContext::new_with_signer(
            self.token_metadata_program.to_account_info(),
            anchor_spl::metadata::UpdateMetadataAccountsV2 {
                metadata: self.avs_token_metadata.to_account_info(),
                update_authority: self.endo_avs.to_account_info(),
            },
            &signer_seeds,
        );

        anchor_spl::metadata::update_metadata_accounts_v2(
            metadata_ctx,
            None,
            token_metadata.into(),
            None,
            None,
        )?;

        Ok(())
    }
}

The lack of validation of user-provided inputs for excessively large values can lead to unintended behavior in off-chain premises, such as weird website rendering, and also pollute the system state with inadequate data.

It is recommended to check the length of user-provided inputs against a safe threshold.

Remediation Plan

RISK ACCEPTED: The Solayer team has accepted the risk related to this finding.

The endoavs program in-scope allows the current authority account of each Endogenous AVS to transfer the authority to another account. Such action is permanent and irrevocable.

The existing implementation of the transfer_authority instruction employs a one-step procedure for authority delegation, which presents a security concern. This method lacks a safeguard against inadvertent delegations or potential hostile takeovers.

- programs/endoavs-program/src/contexts/manage.rs

impl<'info> TransferAuthority<'info> {
    pub fn transfer_authority(&mut self) -> Result<()> {
        self.endo_avs.authority = self.new_authority.key();
        msg!("Transferred authority to {}", self.new_authority.key());
        Ok(())
    }
}

To resolve this issue, it is advisable to establish a two-step process for authority transfer, thereby enhancing the security of the operation. The current authority would first propose a new candidate authority, who would then need to formally accept the role.

This process would be structured as follows:

1. Proposal by Current Authority: The current signer proposes a new candidate signer. This action updates the candidate_authority field in the endo_avs account's state. This step assumes the prior creation of an additional field candidate_authority on state/endoavs.rs.

2. Acceptance by New Authority: The proposed candidate_authority formally accepts the role. This step transfers the authority status from the current authority to the candidate_authority.

Remediation Plan

ACKNOWLEDGED: The Solayer team has acknowledged this finding.

It is considered best practice when developing Solana programs to emit events when important modifications to the state are performed, such as Metadata modifications and authority transfers.

- programs/endoavs-program/src/contexts/manage.rs

impl<'info> TransferAuthority<'info> {
    pub fn transfer_authority(&mut self) -> Result<()> {
        self.endo_avs.authority = self.new_authority.key();
        msg!("Transferred authority to {}", self.new_authority.key());
        Ok(())
    }
}

- programs/endoavs-program/src/contexts/manage.rs

impl <'info> UpdateEndoAVSInfo<'info> {
    pub fn update(&mut self, name: Option<String>, url: Option<String>) -> Result<()> {
        if let Some(name) = name {
            require!(name.len() < MAX_ENDO_AVS_NAME_LENGTH, EndoAVSError::NameTooLong);
            self.endo_avs.name = name;
        }
        if let Some(url) = url {
            require!(url.len() < MAX_ENDO_AVS_URL_LENGTH, EndoAVSError::URLTooLong);
            self.endo_avs.url = url;
        }
        Ok(())
    }
}

- programs/endoavs-program/src/contexts/metadata.rs

impl<'info> AVSTokenMetadata<'info> {
    pub fn update(&mut self, name: String, symbol: String, uri: String) -> Result<()> {
        if !symbol.ends_with(REQUIRED_TOKEN_SYMBOL_SUFFIX) {
            return Err(EndoAVSError::InvalidTokenSymbol.into());
        }

        let token_metadata = DataV2 {
            name,
            symbol,
            uri,
            seller_fee_basis_points: 0,
            creators: None,
            collection: None,
            uses: None,
        };

        let bump = [self.endo_avs.bump];
        let signer_seeds: [&[&[u8]]; 1] = [&[
            b"endo_avs",
            self.avs_token_mint.to_account_info().key.as_ref(),
            &bump,
        ][..]];

        let metadata_ctx = CpiContext::new_with_signer(
            self.token_metadata_program.to_account_info(),
            anchor_spl::metadata::UpdateMetadataAccountsV2 {
                metadata: self.avs_token_metadata.to_account_info(),
                update_authority: self.endo_avs.to_account_info(),
            },
            &signer_seeds,
        );

        anchor_spl::metadata::update_metadata_accounts_v2(
            metadata_ctx,
            None,
            token_metadata.into(),
            None,
            None,
        )?;

        Ok(())
    }
}

It was identified that events are not being emitted for the annotated important state operations.

Ensure that all critical actions within the program emit corresponding events, such as when transferring the authority or updating token information.

Remediation Plan

ACKNOWLEDGED: The Solayer team has acknowledged this finding.

The program in-scope does not prevent the delegate and undelegate methods from being called with amount == 0.

- programs/endoavs-program/src/contexts/delegate.rs

    pub fn delegate(&mut self, amount: u64) -> Result<()> {
        // Transfer tokens from user to the delegated token vault
        let transfer_accounts = TransferChecked {
            from: self.staker_delegated_token_account.to_account_info(),
            to: self.delegated_token_vault.to_account_info(),
            mint: self.delegated_token_mint.to_account_info(),
            authority: self.staker.to_account_info(),
        };
        let transfer_ctx = CpiContext::new(self.token_program.to_account_info(), transfer_accounts);
        transfer_checked(transfer_ctx, amount, self.delegated_token_mint.decimals)?;

        let bump = [self.endo_avs.bump];
        let signer_seeds: [&[&[u8]]; 1] = [&[
            b"endo_avs",
            self.avs_token_mint.to_account_info().key.as_ref(),
            &bump,
        ][..]];

        let mint_ctx = CpiContext::new_with_signer(
            self.token_program.to_account_info(),
            MintTo {
                to: self.staker_avs_token_account.to_account_info(),
                mint: self.avs_token_mint.to_account_info(),
                authority: self.endo_avs.to_account_info(),
            },
            &signer_seeds[..],
        );
        mint_to(mint_ctx, amount)?;

        Ok(())
    }

- programs/endoavs-program/src/contexts/delegate.rs

    pub fn undelegate(&mut self, amount: u64) -> Result<()> {
        // Burn EndoAVS tokens from the user
        let burn_accounts = Burn {
            from: self.staker_avs_token_account.to_account_info(),
            mint: self.avs_token_mint.to_account_info(),
            authority: self.staker.to_account_info(),
        };
        let burn_ctx = CpiContext::new(self.token_program.to_account_info(), burn_accounts);
        burn(burn_ctx, amount)?;

        let bump = [self.endo_avs.bump];
        let signer_seeds: [&[&[u8]]; 1] = [&[
            b"endo_avs",
            self.avs_token_mint.to_account_info().key.as_ref(),
            &bump,
        ][..]];

        let transfer_accounts = TransferChecked {
            from: self.delegated_token_vault.to_account_info(),
            to: self.staker_delegated_token_account.to_account_info(),
            mint: self.delegated_token_mint.to_account_info(),
            authority: self.endo_avs.to_account_info(),
        };
        let transfer_ctx = CpiContext::new_with_signer(
            self.token_program.to_account_info(),
            transfer_accounts,
            &signer_seeds,
        );
        transfer_checked(transfer_ctx, amount, self.delegated_token_mint.decimals)?;

        Ok(())
    }

While this condition does not lead to immediate financial loss, it should be checked to keep overall consistency.

Consider adding a verification before the execution of the delegate and undelegate methods, blocking those actions with amount == 0.

Remediation Plan

ACKNOWLEDGED: The Solayer team has acknowledged this finding.

The current implementation of methods that change endo_avs token informations lacks proper input validation, which can lead to security vulnerabilities.

Metadata, such as name, symbol, and uri, and also token name and symbol, can be freely provided by users when creating or updating EndoAVS metadata. If not properly sanitized in the front-end, this metadata can be used as an attack vector for Stored Cross-Site Scripting (XSS), and other well-known web vulnerabilities.

- programs/endoavs-program/src/contexts/manage.rs

impl <'info> UpdateEndoAVSInfo<'info> {
    pub fn update(&mut self, name: Option<String>, url: Option<String>) -> Result<()> {
        if let Some(name) = name {
            require!(name.len() < MAX_ENDO_AVS_NAME_LENGTH, EndoAVSError::NameTooLong);
            self.endo_avs.name = name;
        }
        if let Some(url) = url {
            require!(url.len() < MAX_ENDO_AVS_URL_LENGTH, EndoAVSError::URLTooLong);
            self.endo_avs.url = url;
        }
        Ok(())
    }

impl<'info> AVSTokenMetadata<'info> {
    pub fn update(&mut self, name: String, symbol: String, uri: String) -> Result<()> {
        if !symbol.ends_with(REQUIRED_TOKEN_SYMBOL_SUFFIX) {
            return Err(EndoAVSError::InvalidTokenSymbol.into());
        }

        let token_metadata = DataV2 {
            name,
            symbol,
            uri,
            seller_fee_basis_points: 0,
            creators: None,
            collection: None,
            uses: None,
        };

        let bump = [self.endo_avs.bump];
        let signer_seeds: [&[&[u8]]; 1] = [&[
            b"endo_avs",
            self.avs_token_mint.to_account_info().key.as_ref(),
            &bump,
        ][..]];

        let metadata_ctx = CpiContext::new_with_signer(
            self.token_metadata_program.to_account_info(),
            anchor_spl::metadata::UpdateMetadataAccountsV2 {
                metadata: self.avs_token_metadata.to_account_info(),
                update_authority: self.endo_avs.to_account_info(),
            },
            &signer_seeds,
        );

        anchor_spl::metadata::update_metadata_accounts_v2(
            metadata_ctx,
            None,
            token_metadata.into(),
            None,
            None,
        )?;

        Ok(())
    }
}

If an attacker manages to successfully craft valid payloads using on-chain state to weaponize it, the attack can ultimately lead to critical consequences such as account take-over and arbitrary script execution on victim's browser.

Given that on-chain primitives do not allow for proper sanitization of inputs, and considering the myriad of payloads that can affect web applications, it is recommended to conduct a thorough examination of off-chain components, such as back-end and front-end applications.

Ensure that malicious on-chain payloads are properly sanitized in off-chain premises to prevent payloads from being rendered in a way that could execute arbitrary code in users' browsers.

Remediation Plan

ACKNOWLEDGED: The Solayer team has acknowledged this finding.

The usage of msg! is usually advisable during tests, and will incur in additional computational budget when the instruction is processed in Mainnet.

- programs/endoavs-program/src/contexts/manage.rs

impl<'info> TransferAuthority<'info> {
    pub fn transfer_authority(&mut self) -> Result<()> {
        self.endo_avs.authority = self.new_authority.key();
        msg!("Transferred authority to {}", self.new_authority.key());
        Ok(())
    }
}

Consider removing debugging messages before Mainnet deployment.

Remediation Plan

ACKNOWLEDGED: The Solayer team has acknowledged this finding.

It was identifying during the assessment of the program endo_avs in-scope that its dependencies for the Anchor framework and also for Solana are not current.

[[package]]
name = "solana-program"
version = "1.18.7"

[[package]]
name = "anchor-lang"
version = "0.29.0"

It is recommended to update dependencies to their current versions, as specified:

• Solana: v1.18.20

• Anchor: v0.31.0

Remediation Plan

SOLVED: The Solayer team has solved this issue as recommended. The commit hash containing the modification is 46c09073a6dad390f435dc76f17e35849f2c6d1b.