Rig Labs — USDM Oracle Contract

Audit report published Oct 2025. Fuel · Sway.

Findings at a glance

Severity	Count
High	1
Medium	1
Low	1
Informational	2
Total	5

Summary

Safe Edges reviewed the oracle contract behind Rig Labs' USDM on Fuel in October 2025. Five issues were identified: one High, one Medium, one Low and two Informational. The High issue was a staleness check that compared Fuel's TAI64 block timestamps directly with UNIX oracle timestamps, and the Medium issue was a transfer_ownership function that recursively called itself and always reverted. All five were fixed.

Read the full report (PDF).

Findings

High (1)

• H-01 Inconsistent Timestamp Comparison Between Fuel TAI64 and Oracle UNIX Formats — Resolved

Medium (1)

• M-01 Recursive transfer_ownership Call Causes Guaranteed Revert — Resolved

Low (1)

• L-01 get_price Uses Pyth Price Without Validating Confidence Interval — Resolved

Informational (2)

• I-01 Missing Zero Address Validation in transfer_ownership — Resolved
• I-02 get_price Always Prioritizes Stork Oracle, Ignoring Potentially Fresher Data — Resolved

More published reports

Related services

Get a fixed quote in 24 hours

Send the repository and a commit hash through the contact form, message @bugtester25 on Telegram, or book a 30-minute scoping call. 200+ protocols audited · $4B+ secured · 0 hacks post-audit. Prefer email? info@safeedges.in.