Skip to main content

Shield Vault — Adversarial Security Audit

FieldValue
Programmagma_shield_vault v0.1.0
NetworkSolana devnet
Program ID4ri6AGT37GrL6mzuFdeVc6Wa2H7Q7srnCsQjkGj4v7my
Anchor version0.32.1
DateMay 2026
ResultAll 20 tests passing — no critical vulnerabilities

Overview

The Shield vault adversarial test suite covers the full coverage lifecycle across 20 scenarios: initialization, coverage creation, backing mechanics, oracle resolution, payout distribution, access-control guards, and circuit-breaker functionality. All tests run against the live devnet deployment.

Test results

IDTestCategoryResult
S1Initialize program stateSetupPASS
S2Open coverage periodSetupPASS
S3SAFE backing — discovery window 2.0× multiplierHappy pathPASS
S4EXPLOIT backingHappy pathPASS
S5Reject backing below 0.1 SOL minimumAdversarialPASS
S6Reject oracle submission before period_endAdversarialPASS
S7Reject backing after coverage period expiredAdversarialPASS
S8Oracle submits SAFE resolutionHappy pathPASS
S9Reject duplicate oracle submissionAdversarialPASS
S10Finalize SAFE resolution — exploit pool becomes winner poolHappy pathPASS
S11SAFE winner claims principal + pro-rata exploit pool shareHappy pathPASS
S12Reject double claimAdversarialPASS
S13Loser yield claim (0 on devnet)Happy pathPASS
S14Reject claim on wrong resolution stateAdversarialPASS
S15EXPLOIT winner — graceful skip when unfinalizedHappy pathPASS
S16Reject claim_exploit_winner on a SAFE-resolved protocolAdversarialPASS
S17Full refund path — 100% principal returnedHappy pathPASS
S18Reject backing on a refunded protocolAdversarialPASS
S19Pause/resume circuit breakerAdversarialPASS
S20Reject unauthorized oracle signerAdversarialPASS

Key findings

S3 — Discovery window multiplier. Backing within the first 20% of a coverage window correctly stores multiplier_bps = 20000 (2.0×) in the ShieldBackingRecord. Later backers receive 10000 (1.0×). The multiplier is used by the backend for conviction scoring and does not affect on-chain SOL payout amounts.

S9 — Oracle vote uniqueness. The OracleSubmission PDA uses init (not init_if_needed) with seeds ["shield_oracle", protocol_id, oracle_pubkey]. Anchor's init constraint enforces exactly one vote per oracle per protocol — no application-level deduplication is needed.

S11 — SAFE winner dual-vault transfer. The contract correctly separates the two transfer sources: principal from safe_vault, winner share from exploit_vault. An earlier version erroneously attempted to pay both from safe_vault; this was caught during testing and fixed before final deployment.

S17 — Refund state immutability. After refund_all sets oracle_status = 4, all subsequent back_shield calls are rejected with AlreadyRefunded. The refund state is final and cannot be reversed.

S19 — Circuit breaker isolation. The test uses try/finally to guarantee the program always resumes even on assertion failures — critical on a live shared network where a paused program would block subsequent runs.

Payout mechanics

SAFE resolution (no exploit confirmed)

SAFE backers receive their principal back plus a pro-rata share of the entire EXPLOIT pool (losers' forfeited principal), plus any yield earned during the window. EXPLOIT backers forfeit their principal but retain any yield earned.

EXPLOIT resolution — Community Shield

The SAFE pool is split: 58% to EXPLOIT backers pro-rata, 39% to the MAGMA Core treasury via CPI, and 3% to the Seam pool via CPI. EXPLOIT backers additionally receive their own principal back plus yield earned.

EXPLOIT resolution — Partnership Shield

The SAFE pool is split: 50% to the protocol wallet (self-hedge return), 35% to EXPLOIT backers, 12% to the MAGMA Core treasury, and 3% to the Seam pool. EXPLOIT backers receive their principal plus yield.

Known limitations

These items are flagged for resolution before mainnet. All are configuration-level changes rather than code-level vulnerabilities.

ItemStatusAction required
EXPLOIT CPI integrationPre-mainnetSeam / core pools must accept the Shield CPI authority. Currently initialized with the backing-vault authority only.
Yield off-chain trackingBy designDeFi yield is tracked off-chain and passed as a parameter at claim. Devnet yield = 0. Mainnet requires a backend proof system.
Oracle threshold = 1Devnet onlyMainnet must set to 3+ (Pyth, Switchboard, RedStone, AI Oracle).
Resolution timelock = 0sDevnet onlyMainnet must set to 172,800 seconds (48 hours) for the dispute window.
Arcium MPC stubsMainnet onlyAll ARCIUM_STUB comments require full Arcium SDK integration before mainnet.
Admin authority = keypairMainnet onlyMainnet must replace with a Squads multisig PDA.

Companion suite — backing vault

The magma_backing_vault test suite was fully rewritten to match the current contract API. All 11 functional tests pass.

IDTestCategoryResult
B0Initialize program state (skip if exists)SetupPASS
B1Create narrative with deadlineSetupPASS
B2Back narrative — correct API with program_state + narrative_vaultHappy pathPASS
B3Additional backing accumulates on the same recordHappy pathPASS
B4Reject backing below minimum (100 lamports)AdversarialPASS
B5Reject backing above maximum (11 SOL)AdversarialPASS
B6Oracle submits TRUE resolution after deadlineHappy pathPASS
B7Reject duplicate oracle submissionAdversarialPASS
B8Reject backing after oracle resolutionAdversarialPASS
B9FALSE resolution + reject wrong claim typeAdversarialPASS
B10Full refund path — 100% principal returnedHappy pathPASS
B11Reject unauthorized oracle signerAdversarialPASS

finalize_resolution and claim_payout require live CPI calls to all four pool programs (forge, seam, core, echo) and are covered separately as integration tests.

Combined test coverage

SuiteTestsPassingNetwork
magma_shield_vault2020Solana devnet
magma_backing_vault1212Solana devnet
Total3232

Conclusion

The magma_shield_vault program passed all 20 adversarial test cases. All critical paths — SAFE resolution with dual-vault claim, the refund path, the pause/resume circuit breaker, oracle consensus, and double-claim prevention — behave as specified. The contract is suitable for continued devnet testing. Six items are flagged for resolution before mainnet, all configuration-level rather than code-level. No reentrancy, overflow, or unauthorized access vectors were identified.

Full PDF reports (magma_shield_vault_adversarial_audit.pdf and magma_backing_vault_adversarial_audit.pdf) are available from the MAGMA team.


MAGMA Protocol | magma_shield_vault | Adversarial Security Audit | May 2026