Smart Contract Code

Review And Security

Analysis Report

Customer: RedStone

Date: 27/05/2025
We express our gratitude to the RedStone team for the collaborative engagement that
enabled the execution of this Smart Contract Security Assessment.

RedStone is a decentralized oracle protocol that aggregates on-chain and off-chain data (such
as asset price feeds) and delivers it on-chain with cryptographic proofs to ensure data
integrity and authenticity to provide reliable, low-latency data for smart contracts and
decentralized applications.

The scope of the audit is update of solana connector from revision

713b2df04ec81cb3d4ba7e1336b17ba2631a2cd4 to revision 2046ac07e94003e1f2bde5f21ad138115595dec6 .

Document

Smart Contract Code Review and Security Analysis Report for

Name
RedStone

Audited By Bartosz Barwikowski

Approved By Bartosz Barwikowski

Website https://redstone.finance/

Changelog 27/05/2025 - Final Report

Platform Solana

Language Rust

Tags Oracle

Methodology https://hackenio.cc/sc_methodology

Review Scope

Repository https://github.com/redstone-finance/redstone-oracles-monorepo

Commit 2046ac07e94003e1f2bde5f21ad138115595dec6

2
Audit Summary

The system users should acknowledge all the risks summed up in the risks section of the
report

0 0 0 0
Total Findings Resolved Accepted Mitigated

Findings by Severity

Severity Count
Critical 0
High 0
Medium 0
Low 0

3
Table of Contents

System Overview 5
Findings 7
Vulnerability Details 7
Observation Details 7
Disclaimers 8
Appendix 1. Definitions 9
Severities 9
Potential Risks 9
Appendix 2. Scope 10
System Overview

The provided patch introduces several modifications to the RedStone Solana Price Adapter.
The key changes are:

1. Enhanced **PriceData** Account: The on-chain PriceData structure in state.rs was

augmented with new fields: write_slot_number (to record the slot of the update), decimals (to
store the price's decimal exponent, defaulting to 8), and a _reserved byte array for future
upgrades. The write_price instruction in write_price.rs was updated to populate these fields.
2. Modified Update Interval for Non-Trusted Updaters: The min_interval_between_updates_ms

configuration in config.rs was significantly increased from 40 seconds to 2 days. This

primarily restricts the update frequency for non-trusted updaters, unless they provide a
data package with a more recent timestamp than the existing on-chain data.
3. Adjusted Time-Based Configurations & Trusted Updater: The max_timestamp_ahead_ms in
config.rs was reduced from 3 minutes to 1 minute, tightening the validation for future-
dated data packages. Additionally, one of the public keys in the TRUSTED_UPDATERS list was
changed.
4. Naming Convention Update: The program and package names in lib.rs and Cargo.toml

were changed from price-adapter to redstone-solana-price-adapter for better clarity and

consistency.
5. RedStone SDK Dependency Update: The redstone Rust SDK dependency specified in
Cargo.toml was updated from tag 2.0.0 to 2.0.1 .

5
Findings

Vulnerability Details

Observation Details

6
Disclaimers

Hacken Disclaimer

The smart contracts given for audit have been analyzed based on best industry practices at
the time of the writing of this report, with cybersecurity vulnerabilities and issues in smart
contract source code, the details of which are disclosed in this report (Source Code); the
Source Code compilation, deployment, and functionality (performing the intended functions).

The report contains no statements or warranties on the identification of all vulnerabilities and
security of the code. The report covers the code submitted and reviewed, so it may not be
relevant after any modifications. Do not consider this report as a final and sufficient
assessment regarding the utility and safety of the code, bug-free status, or any other contract
statements.

While we have done our best in conducting the analysis and producing this report, it is
important to note that you should not rely on this report only — we recommend proceeding
with several independent audits and a public bug bounty program to ensure the security of
smart contracts.

English is the original language of the report. The Consultant is not responsible for the
correctness of the translated versions.

Technical Disclaimer

Smart contracts are deployed and executed on a blockchain platform. The platform, its
programming language, and other software related to the smart contract can have
vulnerabilities that can lead to hacks. Thus, the Consultant cannot guarantee the explicit
security of the audited smart contracts.

7
Appendix 1. Definitions

Severities
When auditing smart contracts, Hacken is using a risk-based approach that considers
Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score
severities.

Reference on how risk scoring is done is available through the repository in our Github
organization:

hknio/severity-formula

Severity Description
Critical vulnerabilities are usually straightforward to exploit and can lead to the
Critical
loss of user funds or contract state manipulation.
High vulnerabilities are usually harder to exploit, requiring specific conditions, or
High have a more limited scope, but can still lead to the loss of user funds or contract
state manipulation.
Medium vulnerabilities are usually limited to state manipulations and, in most
Medium cases, cannot lead to asset loss. Contradictions and requirements violations. Major
deviations from best practices are also in this category.
Major deviations from best practices or major Gas inefficiency. These issues will
Low
not have a significant impact on code execution.

Potential Risks
The "Potential Risks" section identifies issues that are not direct security vulnerabilities but
could still affect the project’s performance, reliability, or user trust. These risks arise from
design choices, architectural decisions, or operational practices that, while not immediately
exploitable, may lead to problems under certain conditions. Additionally, potential risks can
impact the quality of the audit itself, as they may involve external factors or components
beyond the scope of the audit, leading to incomplete assessments or oversight of key areas.
This section aims to provide a broader perspective on factors that could affect the project's
long-term security, functionality, and the comprehensiveness of the audit findings.

8
Appendix 2. Scope

The scope of the project includes the following smart contracts from the provided repository:

Scope Details
Repository https://github.com/redstone-finance/redstone-oracles-monorepo
Commit 2046ac07e94003e1f2bde5f21ad138115595dec6
Whitepaper https://github.com/redstone-finance/redstone-oracles-monorepo
https://github.com/redstone-finance/redstone-oracles-
Requirements monorepo/tree/7aaa97cbe188b80662023981f075e611f3e15b7d/packages/solana-
connector/solana
https://github.com/redstone-finance/redstone-oracles-
Technical
monorepo/tree/7aaa97cbe188b80662023981f075e611f3e15b7d/packages/solana-
Requirements
connector/solana