Telcoin

We express our gratitude to the Telcoin team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

The Peg Stability Vault (PSV) is a Solana program that enables 1:1 token swaps between a stable token and a gem token at parity, minus configurable basis-point fees.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

The project provides a comprehensive README covering deployment, architecture, devnet setup, and script usage. An invariant specification document details every security property with enforcement references and test mappings. Inline documentation covers public instruction handlers and key constants, though helper function internals and complex fee calculation logic contain limited explanatory comments.

Code quality

The codebase follows standard Anchor framework patterns and is organized as a single program with a single source file. Dependencies are limited to well-established crates: anchor-lang, anchor-spl, and spl-token-2022. Several access control and input validation issues were identified and reported, along with multiple informational improvements to account structure and event design.

Test coverage

Code coverage of the project can not be measured. However, the test suite includes both Rust-based unit and integration tests and TypeScript integration tests against a local validator.

• Test files cover initialization, swaps, fee calculation, rate limiting, admin operations, transfer fees, and vault closure.

• Formal coverage metrics were not measured; adding property-based fuzz testing for swap arithmetic and rate limiting edge cases is recommended.

The Peg Stability Vault is a Solana program built with the Anchor framework that facilitates 1:1 swaps between two SPL tokens referred to as "stable" and "gem." The vault holds reserves of both tokens and mediates exchanges at a fixed parity rate, collecting configurable basis-point fees on each swap direction. The program supports both classic SPL Token and Token-2022 mints, allowing mixed token program configurations within a single vault.

The vault is initialized by the program upgrade authority, who becomes the initial admin. Initialization creates a Program Derived Address (PDA) seeded by the two mint addresses, along with associated token accounts for both mints owned by the vault PDA. At initialization, the program validates that both mints share the same decimal precision to ensure the 1:1 peg is meaningful at the base denomination level. For Token-2022 mints, the program rejects mints with active transfer fee configurations.

Two primary swap instructions operate the vault. The buy gem instruction accepts stable tokens from the user and returns gem tokens minus an input fee. The sell gem instruction accepts gem tokens and returns stable tokens minus an output fee. Both instructions enforce a minimum output amount parameter for slippage protection. Fee calculation uses ceiling division to ensure the protocol never undercharges, and fees are retained in the vault rather than transferred to a separate address. Whitelisted addresses bypass fee collection entirely.

Rate limiting operates on two levels: a per-swap maximum restricts individual transaction size, and a per-slot cumulative maximum caps total swap volume within a single Solana slot. Both limits are independently configurable and can be disabled by setting them to zero. When the admin updates rate limit parameters, slot tracking state resets to prevent stale accounting from blocking swaps under new configurations.

The program implements role-based access control with four distinct roles. The admin and treasury roles use a two-step propose-and-accept transfer pattern to prevent accidental reassignment. The pauser and unpauser roles are set directly by the admin. An emergency pause mechanism blocks all swap instructions while allowing administrative operations and treasury withdrawals to continue. Vault closure requires the vault to be paused and all whitelist entries removed; remaining token balances are automatically swept to treasury-designated accounts before the vault PDA is closed.

Privileged roles

• Admin (Vault): The admin role is set at vault initialization and must match the program upgrade authority. The admin can configure input and output fee rates up to a hardcoded 10% cap, set per-swap and per-slot rate limits, manage the fee exemption whitelist, assign pauser and unpauser addresses, propose admin and treasury transfers, and close the vault. Compromise of the admin key would allow fee manipulation up to the cap, disabling rate limits, whitelisting arbitrary addresses for fee-free swaps, and shutting down the vault by pausing and closing it. No multisig or timelock protects this role.

• Treasury (Vault): The treasury role can withdraw any amount of either token from the vault reserves to a designated recipient account. The treasury address is set at initialization and transferable via the two-step propose-and-accept pattern. Compromise of the treasury key would allow draining all vault reserves. No multisig or timelock protects this role.

• Pauser (Vault): The pauser can halt all swap operations by activating the pause state. While paused, no user can execute buy or sell instructions. Misuse would result in a denial-of-service for all vault users. The pauser address is assigned directly by the admin.

• Unpauser (Vault): The unpauser can restore swap operations by deactivating the pause state. The unpauser address is assigned directly by the admin. If the unpauser key is lost while the vault is paused, swap operations cannot resume unless the admin assigns a new unpauser.

• Upgrade Authority (Program): The Solana BPF loader upgrade authority can replace the program binary at any time. The initialization instruction enforces that the initial admin matches the upgrade authority, but the upgrade authority retains independent ability to deploy new program logic regardless of vault state. A compromised upgrade authority could deploy a malicious implementation that bypasses all access controls and drains vault reserves.

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope