Skip to content

Commit 3d4459f

Browse files
Copilot0xrinegade
Copilot
and
0xrinegade
committed
Fix osvm audit panic by correcting Tera template initialization and syntax
Co-authored-by: 0xrinegade <[email protected]>
1 parent 3369786 commit 3d4459f

File tree

5 files changed

+314
-7
lines changed

5 files changed

+314
-7
lines changed

‎local-audit/osvm_audit_report_20250801_195609.typ‎

Lines changed: 307 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,307 @@
1+
#set document(title: "OSVM Security Audit Report")
2+
#set page(numbering: "1")
3+
#set text(size: 11pt)
4+
#set heading(numbering: "1.")
5+
6+
#align(center)[
7+
#text(size: 24pt, weight: "bold")[OSVM Security Audit Report]
8+
9+
#v(1em)
10+
11+
#text(size: 14pt)[Comprehensive Security Assessment]
12+
13+
#v(2em)
14+
15+
#text(size: 12pt)[
16+
Generated: 2025-08-01 19:56:09 UTC
17+
18+
Version: 0.4.3
19+
20+
Security Score: 75/100
21+
22+
Compliance Level: Moderate
23+
]
24+
]
25+
26+
#pagebreak()
27+
28+
= Executive Summary
29+
30+
This report presents the results of a comprehensive security audit conducted on the OSVM (Open SVM) CLI application. The audit identified 6 findings across various security domains.
31+
32+
#table(
33+
columns: (auto, auto),
34+
stroke: none,
35+
[*Metric*], [*Value*],
36+
[Total Findings], [6],
37+
[Critical], [1],
38+
[High], [2],
39+
[Medium], [3],
40+
[Low], [0],
41+
[Info], [0],
42+
[Security Score], [75/100],
43+
[Compliance Level], [Moderate],
44+
)
45+
46+
47+
#text(fill: red, weight: "bold")[
48+
⚠️ This audit identified 3 critical or high severity findings that require immediate attention.
49+
]
50+
51+
52+
= System Information
53+
54+
#table(
55+
columns: (auto, auto),
56+
stroke: none,
57+
[*Component*], [*Version*],
58+
[Rust], [rustc 1.87.0 (example)],
59+
[Solana], [solana-cli 2.2.7 (example)],
60+
[OS], [Linux x86_64],
61+
[Architecture], [x86_64],
62+
)
63+
64+
= Security Findings
65+
66+
67+
== Security (1 findings)
68+
69+
70+
=== OSVM-001 - Example security finding
71+
72+
*Severity:* Medium
73+
*Category:* Security
74+
*CWE ID:* CWE-200
75+
*CVSS Score:* 5
76+
77+
*Description:*
78+
This is an example security finding for demonstration purposes
79+
80+
*Impact:*
81+
Potential information disclosure
82+
83+
*Recommendation:*
84+
Review and implement proper access controls
85+
86+
*Code Location:* src/example.rs
87+
88+
89+
*References:*
90+
91+
- https://cwe.mitre.org/data/definitions/200.html
92+
93+
94+
95+
96+
97+
== Solana Security (5 findings)
98+
99+
100+
=== OSVM-SOL-001 - Missing signer validation in Solana program
101+
102+
*Severity:* Critical
103+
*Category:* Solana Security
104+
*CWE ID:* CWE-862
105+
*CVSS Score:* 9
106+
107+
*Description:*
108+
Detected potential missing signer validation in program instruction handling
109+
110+
*Impact:*
111+
Unauthorized users could execute privileged operations
112+
113+
*Recommendation:*
114+
Always validate that required accounts are signers using is_signer checks
115+
116+
*Code Location:* src/solana/program.rs
117+
118+
119+
*References:*
120+
121+
- https://book.anchor-lang.com/anchor_bts/security.html
122+
123+
- https://solana.com/developers/guides/getstarted/intro-to-anchor
124+
125+
126+
127+
128+
=== OSVM-SOL-002 - Potential PDA verification bypass
129+
130+
*Severity:* High
131+
*Category:* Solana Security
132+
*CWE ID:* CWE-345
133+
*CVSS Score:* 8
134+
135+
*Description:*
136+
Program uses PDA operations without proper verification of derived addresses
137+
138+
*Impact:*
139+
Attackers could provide arbitrary accounts instead of valid PDAs
140+
141+
*Recommendation:*
142+
Always verify PDA derivation matches expected seeds and program ID
143+
144+
*Code Location:* src/solana/pda.rs
145+
146+
147+
*References:*
148+
149+
- https://solanacookbook.com/references/programs.html#how-to-create-a-pda
150+
151+
152+
153+
154+
=== OSVM-SOL-003 - SPL token operations without authority checks
155+
156+
*Severity:* High
157+
*Category:* Solana Security
158+
*CWE ID:* CWE-862
159+
*CVSS Score:* 8
160+
161+
*Description:*
162+
Token operations performed without proper authority validation
163+
164+
*Impact:*
165+
Unauthorized token operations could lead to fund theft
166+
167+
*Recommendation:*
168+
Always verify token authorities before performing operations
169+
170+
*Code Location:* src/solana/token.rs
171+
172+
173+
*References:*
174+
175+
- https://spl.solana.com/token
176+
177+
178+
179+
180+
=== OSVM-SOL-004 - Missing MEV protection in trading operations
181+
182+
*Severity:* Medium
183+
*Category:* Solana Security
184+
*CWE ID:* CWE-841
185+
*CVSS Score:* 4.5
186+
187+
*Description:*
188+
Trading operations lack protection against MEV attacks
189+
190+
*Impact:*
191+
Transactions vulnerable to front-running and sandwich attacks
192+
193+
*Recommendation:*
194+
Implement slippage protection and transaction deadlines
195+
196+
*Code Location:* src/solana/dex.rs
197+
198+
199+
*References:*
200+
201+
- https://docs.solana.com/developing/programming-model/transactions
202+
203+
204+
205+
206+
=== OSVM-SOL-005 - Insecure Solana RPC endpoint usage
207+
208+
*Severity:* Medium
209+
*Category:* Solana Security
210+
*CWE ID:* CWE-319
211+
*CVSS Score:* 5
212+
213+
*Description:*
214+
Application uses public or insecure RPC endpoints
215+
216+
*Impact:*
217+
Rate limiting, censorship, or man-in-the-middle attacks on RPC calls
218+
219+
*Recommendation:*
220+
Use HTTPS RPC endpoints and consider private/dedicated RPC providers
221+
222+
*Code Location:* src/config/rpc.rs
223+
224+
225+
*References:*
226+
227+
- https://docs.solana.com/cluster/rpc-endpoints
228+
229+
230+
231+
232+
233+
234+
= Security Recommendations
235+
236+
237+
1. Implement regular security audits
238+
239+
240+
2. Keep dependencies up to date
241+
242+
243+
3. Follow security best practices
244+
245+
246+
4. Implement proper Solana account validation
247+
248+
249+
5. Use secure RPC endpoints and MEV protection
250+
251+
252+
6. Follow Solana security guidelines and best practices
253+
254+
255+
256+
= Compliance Notes
257+
258+
259+
- This audit follows industry security standards
260+
261+
- Findings are categorized using CWE framework
262+
263+
- Solana-specific security checks included
264+
265+
- Critical Solana vulnerabilities require immediate attention
266+
267+
268+
= Statistics
269+
270+
#table(
271+
columns: (auto, auto),
272+
stroke: none,
273+
[*Metric*], [*Value*],
274+
[Total Findings], [6],
275+
[Findings with CWE], [6],
276+
[Findings with CVSS], [6],
277+
[Findings with Location], [6],
278+
[Unique Categories], [2],
279+
[Average CVSS Score], [6.6],
280+
[Coverage Percentage], [100%],
281+
)
282+
283+
= Conclusion
284+
285+
This security audit provides a comprehensive assessment of the OSVM CLI application's security posture. All identified findings should be addressed according to their severity level, with critical and high-severity issues taking priority.
286+
287+
288+
#text(fill: red, weight: "bold")[
289+
⚠️ CRITICAL: 1 critical findings require immediate remediation.
290+
]
291+
292+
293+
294+
#text(fill: orange, weight: "bold")[
295+
⚠️ HIGH: 2 high-severity findings should be addressed promptly.
296+
]
297+
298+
299+
Regular security assessments and continuous monitoring are recommended to maintain a strong security stance.
300+
301+
#align(center)[
302+
#text(size: 10pt, style: "italic")[
303+
Generated by OSVM Security Audit System
304+
305+
End of Report
306+
]
307+
]

‎src/utils/audit_templates.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ pub struct TemplateReportGenerator {
1818
impl TemplateReportGenerator {
1919
/// Create a new template report generator
2020
pub fn new() -> Result<Self> {
21-
let mut tera = Tera::new("templates/**/*").unwrap_or_else(|_| Tera::new("").unwrap());
21+
let mut tera = Tera::new("templates/**/*").unwrap_or_else(|_| Tera::default());
2222

2323
// Register built-in templates
2424
let typst_template = include_str!("../../templates/audit_report.typ");

‎templates/audit_report.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -204,8 +204,8 @@ <h2>Audit Statistics</h2>
204204
<tr><td>Findings with CWE</td><td>{{ statistics.findings_with_cwe }}</td></tr>
205205
<tr><td>Findings with CVSS</td><td>{{ statistics.findings_with_cvss }}</td></tr>
206206
<tr><td>Unique Categories</td><td>{{ statistics.unique_categories }}</td></tr>
207-
<tr><td>Average CVSS Score</td><td>{{ "%.1f" | format(statistics.average_cvss_score) }}</td></tr>
208-
<tr><td>Coverage Percentage</td><td>{{ "%.1f" | format(statistics.coverage_percentage) }}%</td></tr>
207+
<tr><td>Average CVSS Score</td><td>{{ statistics.average_cvss_score | round(precision=1) }}</td></tr>
208+
<tr><td>Coverage Percentage</td><td>{{ statistics.coverage_percentage | round(precision=1) }}%</td></tr>
209209
</table>
210210

211211
<div style="text-align: center; margin-top: 50px; padding-top: 20px; border-top: 1px solid #ddd; color: #666;">

‎templates/audit_report.typ‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,8 +119,8 @@ This report presents the results of a comprehensive security audit conducted on
119119
[Findings with CVSS], [{{ statistics.findings_with_cvss }}],
120120
[Findings with Location], [{{ statistics.findings_with_location }}],
121121
[Unique Categories], [{{ statistics.unique_categories }}],
122-
[Average CVSS Score], [{{ "%.1f" | format(statistics.average_cvss_score) }}],
123-
[Coverage Percentage], [{{ "%.1f" | format(statistics.coverage_percentage) }}%],
122+
[Average CVSS Score], [{{ statistics.average_cvss_score | round(precision=1) }}],
123+
[Coverage Percentage], [{{ statistics.coverage_percentage | round(precision=1) }}%],
124124
)
125125

126126
= Conclusion

‎templates/audit_summary.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@
7777
- **Findings with CWE:** {{ statistics.findings_with_cwe }}
7878
- **Findings with CVSS:** {{ statistics.findings_with_cvss }}
7979
- **Unique Categories:** {{ statistics.unique_categories }}
80-
- **Average CVSS Score:** {{ "%.1f" | format(statistics.average_cvss_score) }}
81-
- **Coverage Percentage:** {{ "%.1f" | format(statistics.coverage_percentage) }}%
80+
- **Average CVSS Score:** {{ statistics.average_cvss_score | round(precision=1) }}
81+
- **Coverage Percentage:** {{ statistics.coverage_percentage | round(precision=1) }}%
8282

8383
---
8484

0 commit comments

Comments
 (0)