RedStone — Fuel SDK

Audit report published Sep 2024. Fuel · Sway.

Findings at a glance

Severity	Count
High	2
Low	7
Total	9

Summary

Safe Edges reviewed RedStone's Fuel SDK between 24 August and 5 September 2024, focusing on the integrity of the price feed mechanism and the timestamp validation implemented in Sway. Nine issues were identified: two High and seven Low. The most significant, H-01, allows an updater to submit an empty feed_ids vector and advance the oracle timestamp without updating prices, so stale prices can be reported as fresh.

Read the full report (PDF).

Findings

High (2)

• H-01 Lack of Validation for Empty feed_ids Allows Oracle Timestamp Manipulation
• H-02 Missing SRC-5 Ownership Standard Implementation

Low (7)

• L-01 SRC-2 Documentation Not Followed
• L-02 Redundant join() Function on Bytes
• L-03 Commented Out Code Left in Production
• L-04 Custom FromBytes Trait Instead of From<Bytes>
• L-05 Unnecessary Payload Struct
• L-06 Use of Magic Numbers in Timestamp Logic
• L-07 Near Duplicate Functions Across Multiple Files

More published reports

Related services

Get a fixed quote in 24 hours

Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.