Reviews
1 audit | | 19 issues fixed | Last reviewed on Sep 6, 2026
VRF
Solana
Audit
Program for delivering random numbers to projects whose business logic relies on randomness.
Audit
Report
Blockchain
Solana
Date
Sep 6, 2026
Code Hash
…
Inherent risks
Inherent risk: A risk for users that comes from a behavior inherent to the smart contract design.
Inherent risks only represent the risks inherent to the smart contract design, which are a subset of all the possible risks. No inherent risk doesn’t mean no risk. It only means that no risk inherent to the smart contract design has been identified. Other kind of risks could still be present. For example, the issues not fixed incur risks for the users, or the smart contracts deployed as upgradeable also incur risks for the users.
5 inherent risks:
- Users have no guarantee that a randomness request will be successfully answered.
- Users might be unable to submit a randomness request when the oracle's queue is full.
- Projects relying on the randomness should be aware that the random value is briefly visible to everyone before its result is provided to the project’s program, and so others can act on it in advance.
- Projects should be aware that the oracle knows requests’ results before anyone else, and could thus act on outcomes in advance.
- Users paying a higher fee for priority requests have no guarantee they will be executed faster.
All details are available in the report.
Issues
Issue: A behavior unexpected by the users or by the project, or a practice that increases the chances of unexpected behaviors to appear.
21 issues reported (2 remaining).
Severity
Reported
Remaining
Critical
An issue intolerable for the users or the project, that must be addressed.
0
0
Major
An issue undesirable for the users or the project, that we strongly recommend to address.
1
0
Medium
An issue uncomfortable for the users or the project, that we recommend to address.
6
0
Minor
An issue imperceptible for the users or the project, that we advise to address for the overall project security.
14
2
Disclaimer
The report makes no statements or warranties regarding the security of the code, the information herein or its usage. It does not constitute legal or investment advice. Authors shall not be liable for any acts or omissions based on the information contained herein.
Address of deployment
No address of deployment associated to this smart contract.