Introduction
We express our gratitude to the RedStone team for the collaborative engagement that enabled the execution of this Security Assessment.
RedStone is a decentralized oracle protocol that aggregates on-chain and off-chain data (such as asset price feeds) and delivers it on-chain with cryptographic proofs to ensure data integrity and authenticity to provide reliable, low-latency data for smart contracts and decentralized applications.
Document | |
|---|---|
| Name | Code Review and Security Analysis Report for RedStone |
| Audited By | Bartosz Barwikowski |
| Approved By | Ataberk Yavuzer |
| Website | https://www.redstone.finance→ |
| Changelog | 16/02/2025 - Preliminary Report |
| 28/04/2025 - Final Report | |
| Platform | Generic |
| Language | Rust |
| Tags | Oracle |
Document
- Name
- Code Review and Security Analysis Report for RedStone
- Audited By
- Bartosz Barwikowski
- Approved By
- Ataberk Yavuzer
- Changelog
- 16/02/2025 - Preliminary Report
- 28/04/2025 - Final Report
- Platform
- Generic
- Language
- Rust
- Tags
- Oracle
Review Scope | |
|---|---|
| Repository | https://github.com/redstone-finance/rust-sdk/→ |
| Commit | 35a303985376b82523f86dcfa31fc1c6df64f3d8 |
Review Scope
- Commit
- 35a303985376b82523f86dcfa31fc1c6df64f3d8
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
Functional Requirements are available in the README and doc comments, detailing how to parse, validate, and aggregate data packages.
Technical Description is partially embedded in Rust doc comments (
//!lines at file heads).Code Comments describe core structures and logic.
Code quality
The development environment is properly configured with Rust’s standard toolchain and optional features.
The architecture is modular and follows good Rust design (split into coherent modules like
core,types,protocol, etc.). Utility crates are separated from core logic.The code uses safe Rust patterns, with minimal unsafe usage.
Each module has fairly robust test coverage.
Test coverage
Code coverage of the project is 100%. The project is a perfect example of how projects should be tested.
The code base includes extensive unit tests in multiple modules (especially aggregator, config, processor, validator).
The tests work correctly even for different target architectures (eg. wasm32-unkown-unkown).
System Overview
RedStone Rust SDK is a library providing:
Data Package structures and decoders (e.g.,
DataPackage,DataPoint,Payload), enabling applications to parse cryptographically signed price feed data.Configurable Aggregation for feed IDs, allowing customization of threshold-based signer validation and feed filtering.
Modular Cryptography with multiple backends (e.g.,
k256for ECDSA on Solana, or pure Rust-based secp256k1 crates).Environment Abstractions for logging and environment-specific implementations (e.g.,
StdEnv,CasperEnv,SolanaEnv).Utilities such as median calculation, slice filtering, and signature recovery.
This SDK is designed for flexible integration across different blockchain environments, ensuring that off-chain aggregated data can be securely transmitted on-chain with authenticity checks.
Privileged roles
This library itself does not define on-chain privileged roles. Instead, the Config structure can be set up by the integrating contract or environment to specify which signers are recognized and how many are required. Any “privileged” concept typically lives in the environment that uses this SDK (e.g., a contract’s admin can mutate the config). The library strictly enforces the signers and thresholds provided in the Config.
Potential Risks
An incorrect or incomplete Config (e.g. zero signers, repeated feed IDs in the config) will result in errors. While the library performs internal checks and errors out, an improperly set signer_count_threshold or timestamps could break data validation.
The library should be used only in smart contract environment where panic is not an issue.
Processing payloads may be compute intensive when a lot of data is provided. It may lead to denial of service issue if library is being incorrectly used, for example in case when fees are being paid by deployer of smart contract instead of users.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-8834 | Panic in Sanitized Trait with Large or Non-Zero Byte Arrays | fixed | Observation | |
| F-2025-8833 | Unverified Signer Processing in make_payload Leads to Unnecessary Computation | accepted | Observation | |
| F-2025-8830 | Out-of-Bounds Slice Panic During Signature Checks | fixed | Observation | |
| F-2025-8822 | Integer Overflow in DataPackage Signature Verification | fixed | Observation |
Findings like these can secure your blockchain.
Appendix 1. Definitions
Severities
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution.
Potential Risks
The "Potential Risks" section identifies issues that are not direct security vulnerabilities but could still affect the project’s performance, reliability, or user trust. These risks arise from design choices, architectural decisions, or operational practices that, while not immediately exploitable, may lead to problems under certain conditions. Additionally, potential risks can impact the quality of the audit itself, as they may involve external factors or components beyond the scope of the audit, leading to incomplete assessments or oversight of key areas. This section aims to provide a broader perspective on factors that could affect the project's long-term security, functionality, and the comprehensiveness of the audit findings.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/redstone-finance/rust-sdk/→ |
| Commit | 35a303985376b82523f86dcfa31fc1c6df64f3d8 |
| Whitepaper | https://docs.redstone.finance/docs/introduction→ |
| Requirements | https://github.com/redstone-finance/rust-sdk/blob/35a303985376b82523f86dcfa31fc1c6df64f3d8/README.md→ |
| Technical Requirements | https://github.com/redstone-finance/rust-sdk/blob/35a303985376b82523f86dcfa31fc1c6df64f3d8/README.md→ |
Scope Details
- Commit
- 35a303985376b82523f86dcfa31fc1c6df64f3d8
Asset | Type |
|---|---|
| lib.rs | Source |
| core/mod.rs | Source |
| core/processor_result.rs | Source |
| core/processor.rs | Source |
| core/aggregator.rs | Source |
| core/config.rs | Source |
| core/validator.rs | Source |
| casper/mod.rs | Source |
| network/error.rs | Source |
| network/mod.rs | Source |
| network/as_str.rs | Source |
| solana/mod.rs | Source |
| radix/mod.rs | Source |
| radix/value_ext.rs | Source |
| types/signer_address.rs | Source |
| types/mod.rs | Source |
| types/value.rs | Source |
| types/bytes.rs | Source |
| types/timestamp_millis.rs | Source |
| types/feed_id.rs | Source |
| crypto/mod.rs | Source |
| utils/mod.rs | Source |
| utils/median.rs | Source |
| utils/trim.rs | Source |
| utils/trim_zeros.rs | Source |
| utils/slice.rs | Source |
| utils/filter.rs | Source |
| protocol/data_package.rs | Source |
| protocol/data_point.rs | Source |
| protocol/constants.rs | Source |
| protocol/mod.rs | Source |
| protocol/payload_decoder.rs | Source |
| protocol/payload.rs | Source |
| protocol/marker.rs | Source |
| contract/verification.rs | Source |
| contract/mod.rs | Source |
| default_ext/mod.rs | Source |
Asset
- lib.rs
Type
- Source
Asset
- core/mod.rs
Type
- Source
Asset
- core/processor_result.rs
Type
- Source
Asset
- core/processor.rs
Type
- Source
Asset
- core/aggregator.rs
Type
- Source
Asset
- core/config.rs
Type
- Source
Asset
- core/validator.rs
Type
- Source
Asset
- casper/mod.rs
Type
- Source
Asset
- network/error.rs
Type
- Source
Asset
- network/mod.rs
Type
- Source
Asset
- network/as_str.rs
Type
- Source
Asset
- solana/mod.rs
Type
- Source
Asset
- radix/mod.rs
Type
- Source
Asset
- radix/value_ext.rs
Type
- Source
Asset
- types/signer_address.rs
Type
- Source
Asset
- types/mod.rs
Type
- Source
Asset
- types/value.rs
Type
- Source
Asset
- types/bytes.rs
Type
- Source
Asset
- types/timestamp_millis.rs
Type
- Source
Asset
- types/feed_id.rs
Type
- Source
Asset
- crypto/mod.rs
Type
- Source
Asset
- utils/mod.rs
Type
- Source
Asset
- utils/median.rs
Type
- Source
Asset
- utils/trim.rs
Type
- Source
Asset
- utils/trim_zeros.rs
Type
- Source
Asset
- utils/slice.rs
Type
- Source
Asset
- utils/filter.rs
Type
- Source
Asset
- protocol/data_package.rs
Type
- Source
Asset
- protocol/data_point.rs
Type
- Source
Asset
- protocol/constants.rs
Type
- Source
Asset
- protocol/mod.rs
Type
- Source
Asset
- protocol/payload_decoder.rs
Type
- Source
Asset
- protocol/payload.rs
Type
- Source
Asset
- protocol/marker.rs
Type
- Source
Asset
- contract/verification.rs
Type
- Source
Asset
- contract/mod.rs
Type
- Source
Asset
- default_ext/mod.rs
Type
- Source