ORE: regolith-labs/ore, entropy and ore-stake

.assert_mut(|v| clock.slot >= v.end_at)?;
...
let hash = solana_program::keccak::hashv(&[&var.end_at.to_le_bytes()]);

• Why it matters: sample is permissionless and accepts the slot end_at itself. During that slot, the slot-hash history cannot yet contain end_at. The same happens if the slot was skipped or sampling is more than 512 slots late. In all three cases the stored hash becomes keccak(end_at), which anyone can compute from round start, and it is write-once.
• Impact: the final value then depends only on the provider's seed. Whoever holds the seed knows the winning square and the top-miner ticket while deploys are still open. Your own CLI computes the outcome this way.
• Who can exploit it: this needs the seed holder, which is why we rate it MEDIUM rather than HIGH, but it undermines the fairness guarantee.
• Fix: require clock.slot > end_at. Never substitute a derivable value: leave the variable unsampled and use a refund or re-target path.

.assert(|v| v.slot_hash != [0; 32])?
.assert(|v| v.seed != [0; 32])?
.assert(|v| v.value != [0; 32])?;

• Why it matters: reset is the only way to advance the round, and it needs the provider's seed. While the round is not reset, checkpoint refuses the current round and close refuses it too, so all SOL deployed in the round stays locked.
• Provider's options: after the slot hash is sampled, the provider can compute the outcome and choose not to reveal it. If the seed is lost, the lock is permanent: there is no timeout and no way to rotate the variable (finding 3).
• Fix: add a reveal deadline after which anyone can trigger a refund (the existing "no randomness" refund branch), and document the trust assumption.

.assert_mut_msg(|v| v.samples > 0, "No samples remaining")?;
...
var.samples -= 1;

• Why it matters: each round's first deploy calls next, which decrements samples. When it goes from 1 to 0, players can still deploy into that round. Reveal then always fails, because validation rejects samples == 0 (var.rs:75), so that round's SOL is locked and no new round can start. The CLI uses a budget of about 1 million samples, and there is no rotation path.
• Fix: refuse to start a round unless more than one sample remains, make the last sample finalisable, add a rotation path, and alert well before the budget runs out.

if treasury.motherlode > max_motherlode || treasury.motherlode < min_motherlode {
    return Ok(());
}

• Why it matters: AutomationConditions.max_production_cost is documented as "Deploy blocked if EMA exceeds this". Reset maintains board.production_cost_ema every round, but no instruction ever compares the two (max_production_cost is only defined and serialised). A user who sets a cost ceiling keeps having SOL deployed by their automation after the ceiling is exceeded.
• Fix: add board.production_cost_ema > automation.conditions.max_production_cost to the same gate. Better, put all condition checks in one conditions_met() method on the automation and call that.

// let new_admin = Pubkey::new_from_array(args.admin);
...
config.protocol.round_slots = new_round_slots;

• Why it matters: the instruction and SDK carry admin, fee_collector, fee_rate, entropy_var_address and entropy_program_id. The handler drops all five and still returns success, so an operator rotating the admin, fee collector or entropy variable gets a successful transaction that changes nothing. The two values it does apply are unbounded:
• round_slots = 0 makes rounds impossible.
• A huge intermission_slots can push reset past the round's fixed expiry, after which miners forfeit their returned SOL.
• Fix: either apply and validate every field, or remove the dead fields and reject non-zero values. Add minimum and maximum bounds for both slot settings, and make expiry relative to the actual reset slot.

// EntropyInstruction::Open => process_open(accounts, data)?,

• Why it matters: ore's NewVar (new_var.rs:32) calls entropy's Open over CPI, but the entropy dispatcher has Open commented out and rejects it. open.rs is unreachable. With VAR_ADDRESS hard-coded in ore, there is no way to rotate or replace the entropy variable, which makes findings 39 and 40 unrecoverable on-chain.
• Fix: re-enable Open with proper authority checks, or remove NewVar, open.rs and the SDK/CLI paths. Read the variable address from config rather than a constant.

.assert_mut(|a| a.executor == *signer_info.key || a.executor == EXECUTOR_ADDRESS)?

• Why it matters: the rule "discretionary strategies must not use the public executor" exists only in automate.rs. Deploy accepts any signer when the executor is the public address, whatever the strategy. Any automation account created before that check, or by a future path, would let anyone choose the amount and squares for the owner's funds.
• Fix: repeat the strategy/executor check in deploy.

.assert_mut(|b| clock.slot >= b.end_slot + config.protocol.intermission_slots)?;

• Why it matters: after reset, end_slot = u64::MAX means "waiting for first deploy". Only the overflow panic of u64::MAX + n stops a second reset on an unstarted round. Built without overflow checks, the sum would wrap and allow repeated resets that mint each time.
• Fix: add an explicit end_slot != u64::MAX check, or use checked_add.

if treasury.total_staked > 0 {
    treasury.rewards_factor += Numeric::from_fraction(amount, treasury.total_staked);
}

• Why it matters: vested_amount advances regardless, so ORE that vests while total stake is zero stays in the treasury token account with no ledger entry. The unit test calls this "by design", but the tokens become permanently unreachable.
• Fix: keep the remainder pending until someone is staked, or add a sweep, and reconcile treasury tokens against the ledger.

self.lifetime_rewards_ore -= fee;

• Why it matters: rewards_ore, refined_ore, lifetime_rewards_ore, total_unclaimed, total_refined and the rewards factor are each mutated inline in checkpoint, claim_ore and update_rewards. Lifetime rewards are gross at checkpoint and net at claim, which makes the ledger hard to reason about.
• Fix: move accrual and claim into one method that updates miner and treasury together, and document what each field means.

round.top_miner = miner.authority;

• Why it matters: Round.top_miner is written in reset (verified winner, or the split sentinel) and again in checkpoint. It holds three kinds of value: a pubkey, the split sentinel or the default key.
• Fix: make reset the single writer and have checkpoint only read the field.

/// Default: u16::MAX (no preference).
...
split_tiles: 0,

• Why it matters: the doc comments say u16::MAX means "no preference", but the code treats 0 as "no preference" and any value above 0 as a request. An integrator following the docs sends 65535. Deploy then selects every solo and every split tile, which is all 25 squares, so the automation spends up to 25 times the intended amount per round.
• Fix: pick one sentinel, clamp solo_tiles + split_tiles to 25 or fewer in automate, and correct the docs (the max_motherlode doc also says u64::MAX for a u16 field).

panic!("Top miner verification failed");
...
panic!("Top miner account cannot be parsed");

• Why it matters: the comment above this block says "dry-run - no errors on failure". The 2026-01-13 change record requires "No panics or transaction failures from this verification". The code panics in three places, so round settlement depends on an off-chain computation being exact.
• Effect on your own CLI: the CLI's reset command computes the winner from a substituted slot hash (ore/cli/src/main.rs:442). Whenever the real slot hash is still available, that winner is wrong and reset fails.
• Fix: either log as specified, or make enforcement an explicit, documented step that returns a typed error. In both cases make the CLI read the actual sampled hash.

pub const ONE_MINUTE_SLOTS: u64 = 200;

• Why it matters: at the roughly 0.4 s slot time the CLI itself assumes, 200 slots is about 80 seconds. The "one day" round expiry is then about 32 hours and the "12 hour" bot window about 16 hours, and both drift with network slot time. The neighbouring doc comments are also attached to the wrong constants.
• Fix: document the slot-time assumption next to the constant, or base the windows on timestamps.

if clock.slot >= round.expires_at {
    miner.checkpoint_id = miner.round_id;
    return Ok(());

• Why it matters: a miner gets back roughly 89 to 99 percent of what they deployed, but only if someone checkpoints them before expiry. After that the claim is zeroed and close sweeps the leftover SOL to the treasury. The checkpoint bot fee is the only safeguard. This is documented design, but the downside falls on users who stop playing.
• Fix: settle lazily on the miner's next action without expiry, or send forfeited SOL to a recoverable pool.

match std::env::var("COMMAND").expect("Missing COMMAND env var").as_str() {

• Why it matters: swap, reset, maintenance, reporting and RPC helpers all live in one file, so changes are hard to review.
• Fix: split it into modules.

let sq_admin = (sq_total / 100).max(1);

• Why it matters: the same admin and protocol fee arithmetic appears in checkpoint.rs (twice), in Round::calculate_fees and twice in the CLI. One CLI copy already uses a different formula. The ADMIN_FEE constant is unused.
• Fix: add one helper in the API crate and call it from reset, checkpoint and the CLI.

async fn submit_transaction(rpc: &RpcClient, payer: &...Keypair, instructions: &[...Instruction])

• Why it matters: the submit, simulate and program-account helpers, including a fixed priority fee, exist in all three CLIs, so a policy change needs three edits.
• Fix: move them into a shared crate.

const LIQ_PCT: u64 = 15;
const LIQ_MANAGER: Pubkey = pubkey!("Ag3Ak...");

• Why it matters: fee shares, the liquidity split, the EMA window and the 100 SOL wrap cap are literals spread across handlers, and the CLI repeats some of them. Config fields for fee rate and fee collector exist but are never read.
• Fix: keep these values in one place, either the constants module or Config, and have clients import them.

let response = reqwest::get(&url).await?;
let seed_response: ...GetSeedResponse = response.json().await?;

• Why it matters: a hung or hostile endpoint can stall the operator tool or exhaust its memory. The on-chain commit check keeps the value itself safe.
• Fix: use a client with a timeout and a capped body size.

pub total_miners: u64,

• Why it matters: the IDL names the same slot num_winners, and total_winnings appears as total_returned_sol. Events carry no version field, so consumers that parse by name or position will misread them.
• Fix: add a version, only append new fields, and keep the IDL in sync.

} else if let Ok(args) = Automate::try_from_bytes(data) {

• Why it matters: the V1 automate fallback, the Liq stub, the undispatched V2 enum and the unused admin config block are compatibility residue. Nothing records why they exist or when they can go.
• Fix: record each item with its removal condition.

entropy-api = "0.1.4"

• Why it matters: ore reads the entropy variable account through the published 0.1.4 layout, while the entropy source in this submission is 0.1.6. Compatibility is assumed, not tested.
• Fix: add a layout test (size, offsets, discriminator) or depend on the workspace version.

// TODO Integrate admin fee

• Why it matters: the admin fee is already paid at line 259, so the TODO is stale. buyback.rs:102 disables a balance assertion with no stated reason.
• Fix: resolve or delete each item, or write down the open question and why it was deferred.

// Find insolvent rounds: group uncheckpointed miners by round.

• Why it matters: the CLI shows that rounds have been under-funded before, but there is no recorded cause and no on-chain solvency check.
• Fix: document the failure mode and assert round solvency in reset (see finding 42).

signer_info.is_signer()?.has_address(&ADMIN_ADDRESS)?;

• Why it matters: admin actions are gated by ADMIN_ADDRESS, by config.protocol.authority (new_var) and by BURY_AUTHORITY (buyback, wrap). Meanwhile several config fields are never read, which makes it unclear who controls what.
• Fix: pick one authoritative source.

pub const ORE_VAR_ADDRESS: Pubkey = pubkey!("BWCaDY96Xe4WkFq1M7UiCCRcChsJ3p51L5KrGzhxgm2E");

• Why it matters: the program constant, this CLI literal and the SDK's derivation (var_pda(board, 0)) can drift apart unnoticed.
• Fix: export one constant and add a unit test that it equals the derived address.

pub fn process_log(accounts: &[AccountInfo<'_>], _data: &[u8]) -> ProgramResult {

• Why it matters: the two handlers differ only in the expected signer.
• Fix: optional. A small shared helper would do.

solana-test-validator -r ... --bpf-program oreV3EG1i9BEgiAJ8b177Z2S2rMarzak4NMv1kULvWv target/deploy/ore.so ...

• Why it matters: the script is a copy of ore's and does not load the staking program, so the staking program cannot be exercised locally.
• Fix: write a script specific to ore-stake.

let liq_amount = total_amount * 0 / 100;

• Why it matters: the comment says 10 percent, the code uses 0 and the program uses 15. The caps also differ: 10 SOL in the CLI, 100 SOL on-chain. The quoted swap size therefore does not match what wrap moves.
• Fix: import the program's constants.

[workspace]
resolver = "2"
members = ["api", "program"]

• Why it matters: unlike ore, entropy declares no release profile with overflow checks, and it pins a different toolchain.
• Fix: align the profiles and toolchains, or record why they differ.

To run the test suite, use the Solana toolchain: cargo test-sbf

• Why it matters: we searched for test folders and test attributes. Unit tests exist only in round.rs, stake.rs and vesting.rs. Nothing covers deploy, reset, checkpoint, claim, bury, buyback or any entropy instruction, which is where most findings in this report sit.
• Fix: add program-level integration tests for the full deploy, reset, checkpoint and claim cycle, including a solvency invariant.

let ix = solana_sdk::system_instruction::transfer(&payer.pubkey(), round_pda, *amount);

• Why it matters: topup_rounds sends operator SOL to under-funded rounds with no confirmation prompt, but the cause of the under-funding is not fixed in the program.
• Fix: fix the cause (finding 42), and make the tool dry-run by default with an explicit confirm flag.

solana program set-buffer-authority "$BUFFER_ADDRESS" --new-buffer-authority "$MULTISIG_AUTHORITY" -um

• Why it matters: nothing compares the on-chain program hash with the local build after the multisig executes, and there is no rollback section. The same applies to entropy/DEPLOY.md.
• Fix: verify the buffer again after the authority transfer, check the program hash after the upgrade, and document a rollback.

solana-verify export-pda-tx "$GITHUB_REPO" --library-name "$LIBRARY_NAME" --program-id "$PROGRAM_ID" ...

• Why it matters: the verification transaction is not pinned to the commit that was built, and the build's hash and size are never printed.
• Fix: pass the commit hash, print the executable hash, and require a clean working tree.

solana-keygen new -o "$BUFFER_KEYPAIR" --no-bip39-passphrase --force

• Why it matters: --force silently overwrites an existing keypair in a shared temporary directory. The same line is in entropy/DEPLOY.md.
• Fix: create a private temporary directory, or check that the file does not exist and drop --force.

sol_log(&format!("Ore accounts: {:?}", ore_accounts.len()).to_string());

• Why it matters: lines that print on every deploy and reset carry no information, cost compute units and bury the warnings that do matter.
• Fix: remove them and keep only distinct warning messages.

**Enforcement phase**: Will be enabled via new program deployment (not a config flag)

• Why it matters: enforcement is already live (see finding 10). The README lists Initialize, SetAdmin, SetFeeCollector and SetFeeRate, none of which exist, and omits Buyback, NewVar, UpdateProtocolConfig and Close. The entropy README lists Open as live.
• Fix: update the docs to match the shipped version.

if round.did_hit_motherlode(r) {
    round.motherlode = treasury.motherlode;
    treasury.motherlode = 0;

• Why it matters: reset always mints up to 1.2 ORE and may move the whole motherlode into the round. Checkpoint pays these only to miners on the winning square. When that square is empty, the minted ORE and the motherlode sit in the treasury with no ledger entry, cannot be claimed, and permanently use up supply headroom.
• Made worse by: zero-amount deploys are accepted, so empty rounds cost almost nothing to create.
• Fix: skip the mint and leave the motherlode in the treasury when the winning square is empty, and reject zero-amount or empty-mask deploys.

let sq_admin = ((deployed / 100) as u64).max(1);
...
protocol_fee += ((deployed.saturating_sub(sq_admin) / 10) as u64).max(1);

• Why it matters: a square holding 1 lamport is charged 2 lamports in fees. Deploy has no minimum amount, and the defined AmountTooSmall error is never raised. In a round dominated by dust, reset tries to send more than the round holds above its rent reserve and reverts until someone donates the shortfall. In mixed rounds, the round can end up short for the last miners to checkpoint, which matches the top-up tooling in finding 32.
• Fix: cap each square's fees at its deployed amount, enforce a minimum deploy amount, and assert round solvency after fees.

let claim_refined = (self.refined_ore * bps) / DENOMINATOR_BPS;
let claim_rewards = (self.rewards_ore * bps) / DENOMINATOR_BPS;

• Why it matters: overflow checks are on, so any miner holding more than about 18,446 ORE unclaimed panics on a full claim (bps = 10,000, the default). They can only claim in smaller slices.
• Fix: compute in 128-bit: ((x as u128 * bps as u128) / 10_000) as u64.

// assert_eq!(post_swap_sol_balance, 0);
assert!(post_swap_ore_balance >= pre_swap_ore_balance);

• Why it matters: the buyback key supplies the whole swap route and data, and the treasury signs. The only checks are that lamports, supply and the ORE balance did not fall, so a route that spends all treasury wSOL for zero ORE passes. That route could come from sandwiching or from a compromised hot key. Slippage protection exists only off-chain.
• Fix: enforce a minimum ORE output and a maximum wSOL spend on-chain, pin the destination account, and put the authority behind a multisig.

if shared_amount > 0 {
    invoke_signed(
        &ore_stake_api::sdk::distribute(*treasury_info.key, shared_amount),

• Why it matters: the staking program rejects distribute when total stake is zero (distribute.rs:30), and the error reverts the whole buyback or bury. If every staker withdraws, buybacks stop until someone stakes again.
• Fix: skip or burn the staker share when nobody is staked.

accounts: vec![AccountMeta::new(signer, true), AccountMeta::new(var, false)],

• Why it matters: the handler expects three accounts (close.rs:6), so every close built with the SDK or CLI fails.
• Fix: add the system program account, or drop it from the handler.

ore_api::sdk::deploy(payer.pubkey(), payer.pubkey(), board.round_id, amount, squares);

• Why it matters: the SDK takes amount first, then round id. The command derives the round address from the amount, so it always fails. No funds move, but the command is unusable.
• Fix: swap the arguments. Consider distinct types for the two values.

spl_token::instruction::transfer(&spl_token::ID, &authority, &recipient, &authority, &[&authority],
    miner.rewards_ore + miner.refined_ore,

• Why it matters: the source is the wallet address, not its token account, and the amount ignores the 10 percent refining fee. Setting RECIPIENT therefore makes the whole claim transaction fail.
• Fix: use the associated token accounts and the net claimed amount.

let filter = RpcFilterType::Memcmp(Memcmp::new_base58_encoded(512, &round_id.to_le_bytes()));

• Why it matters: since the mass field was added, round_id sits at byte 664, and line 520 already uses that offset. The participating-miners command matches the wrong bytes and returns wrong or empty results.
• Fix: derive filter offsets from the struct in one shared helper.

"name": "bury",
"discriminant": { "type": "u8", "value": 13 }

• Why it matters: in the program, 13 is Buyback and Bury is 24. The IDL also lists setAdmin at 15 (UpdateProtocolConfig in the code) and newVar at 17 (19 in the code). It also omits automation fields and checkpoint and deploy accounts. A client generated from it calls the wrong instructions or decodes accounts incorrectly.
• Fix: generate the IDL from source in CI and fail the build on any difference.

members = ["api", "program"]

• Why it matters: ore/cli/Cargo.toml uses version.workspace = true and other inherited fields, but the CLI is neither a member nor excluded, so Cargo refuses to build it as a workspace package. entropy's CLI is set up the same way. Only ore-stake lists its CLI.
• Fix: add the CLI crates to members, or give them their own manifest settings.