Introduction
We express our gratitude to the Opinions.fun team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
Opinions.fun is a token launchpad leveraging a bonding-curve mechanism to enable permissionless creation, trading, and migration of opinion-themed tokens to Raydium pools.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for Opinions.fun |
| Audited By | Przemyslaw Swiatowiec |
| Approved By | Grzegorz Trawinski |
| Website | https://opinions.fun→ |
| Changelog | 02/01/2024 - Preliminary Report, 07/01/2024 - Remediation Review Report |
| Platform | Solana |
| Language | Rust |
| Tags | SPL-22, Launchpad, Raydium |
| Methodology | https://hackenio.cc/sc_methodology→ |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for Opinions.fun
- Audited By
- Przemyslaw Swiatowiec
- Approved By
- Grzegorz Trawinski
- Website
- https://opinions.fun→
- Changelog
- 02/01/2024 - Preliminary Report, 07/01/2024 - Remediation Review Report
- Platform
- Solana
- Language
- Rust
- Tags
- SPL-22, Launchpad, Raydium
- Methodology
- https://hackenio.cc/sc_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/opinionsdotfun→ |
| Commit | 7717f7dbc6f6ea08df52781c7e49e5def418bc3a |
| Remediation Fixes | 84c6dd57380f5c434ab775626fa5e588219556b7 |
Review Scope
- Repository
- https://github.com/opinionsdotfun→
- Commit
- 7717f7dbc6f6ea08df52781c7e49e5def418bc3a
- Remediation Fixes
- 84c6dd57380f5c434ab775626fa5e588219556b7
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional requirements are provided.
Technical description is provided.
Code quality
Some code quality issues were reported as observations in previous part of this report.
The development environment is configured.
Test coverage
The tests are verbose and provide detailed output, but Solana currently lacks a precise tool for measuring test coverage.
System Overview
Opinions.fun is a Solana-based token launchpad that facilitates the creation, trading, and distribution of opinion-themed tokens using a bonding-curve pricing mechanism. Users can create token pools, trade tokens within the protocol, and migrate successful pools to Raydium's AMM for broader market integration. The protocol includes a fee structure for trades and pool setup, with treasury management by an administrator. Core functionalities include token pool creation, trading via exponential bonding curves, fee collection, and migration to Raydium for liquidity expansion.
Key Instructions:
initialize - Initializes the program, setting the administrator and initial fee parameters (
setup_fee,buy_fees,sell_fees).create_pool - Creates a new token pool by depositing a user's tokens into the pool's associated token account and initializing the pool's state, while charging a setup fee.
buy - Allows users to purchase tokens from the pool using the bonding curve, updating the pool's reserves and applying the configured buy fee.
sell - Enables users to sell tokens back to the pool for SOL, adjusting the pool's reserves and applying the configured sell fee.
prepare_raydium - Prepares a token pool for migration to Raydium by transferring assets and wrapping SOL into WSOL once a predefined reserve threshold is met.
initialize_raydium - Finalizes the migration of the token pool to Raydium by creating a liquidity pool on Raydium's AMM.
withdraw_from_treasury - Allows the administrator to withdraw accrued fees from the program's treasury account.
Privileged roles
Administrator: Responsible for initializing the program and setting key parameters such as setup fees, buy fees, and sell fees. Holds the authority to withdraw accrued fees from the treasury account.
Potential Risks
Dependency on Raydium: The program must remain in sync with Raydium’s token policies, such as allowed token types (e.g., disallowing fee-on-transfer tokens). If the program is not updated to reflect Raydium’s evolving requirements, tokens created in the protocol may become incompatible with Raydium.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-8018 | Associated Token Account Initialization Requirement Leading to Potential DoS | fixed | High | |
| F-2025-8059 | Hardcoded Raydium Fee May Cause Protocol to Stop Working if Adjusted | fixed | Medium | |
| F-2025-8058 | Lack of Validation for amm_config in Raydium Pool Initialization | fixed | Medium | |
| F-2024-8012 | Inaccurate Accounting for SPL22 Tokens with Fee-On-Transfer Feature | fixed | Medium | |
| F-2024-8011 | Lack of Validation for SPL22 Extensions in Token Mints | fixed | Medium | |
| F-2024-8020 | Incorrect Rounding Method for SOL Amount in Buy Function | fixed | Low | |
| F-2024-8017 | Lack of Functionality to Modify Fees | fixed | Observation | |
| F-2024-8016 | Missing Functionality to Pause Program Operations | fixed | Observation | |
| F-2024-8015 | Lack of Functionality for Admin Rotation | fixed | Observation | |
| F-2024-8014 | Treasury Account Can Fall Below Rent Exemption Leading to Transaction Failures | fixed | Observation |
Identify vulnerabilities in your smart contracts.
Appendix 1. Definitions
Severities
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution.
Potential Risks
The "Potential Risks" section identifies issues that are not direct security vulnerabilities but could still affect the project’s performance, reliability, or user trust. These risks arise from design choices, architectural decisions, or operational practices that, while not immediately exploitable, may lead to problems under certain conditions. Additionally, potential risks can impact the quality of the audit itself, as they may involve external factors or components beyond the scope of the audit, leading to incomplete assessments or oversight of key areas. This section aims to provide a broader perspective on factors that could affect the project's long-term security, functionality, and the comprehensiveness of the audit findings.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/opinionsdotfun→ |
| Commit | 7717f7dbc6f6ea08df52781c7e49e5def418bc3a |
| Whitepaper | README.md |
| Requirements | README.md |
| Technical Requirements | README.md |
Scope Details
- Repository
- https://github.com/opinionsdotfun→
- Commit
- 7717f7dbc6f6ea08df52781c7e49e5def418bc3a
- Whitepaper
- README.md
- Requirements
- README.md
- Technical Requirements
- README.md
Appendix 3. Additional Valuables
Additional Recommendations
The smart contracts in the scope of this audit could benefit from the introduction of automatic emergency actions for critical activities, such as unauthorized operations like ownership changes or proxy upgrades, as well as unexpected fund manipulations, including large withdrawals or minting events. Adding such mechanisms would enable the protocol to react automatically to unusual activity, ensuring that the contract remains secure and functions as intended.
To improve functionality, these emergency actions could be designed to trigger under specific conditions, such as:
Detecting changes to ownership or critical permissions.
Monitoring large or unexpected transactions and minting events.
Pausing operations when irregularities are identified.
These enhancements would provide an added layer of security, making the contract more robust and better equipped to handle unexpected situations while maintaining smooth operations.