The Unstoppable Domains protocol allows the creation and management of domains on the Solana blockchain. These can be top-level domains, and can also have second-level domains. Second-level domains are in the form of non-fungible tokens (NFTs) minted to the users. Only one domain name can be in circulation.<\/p>\n
Unstoppable Domains engaged Ackee Blockchain Security to perform a security review of Web3 Domains with a total time donation of 13 engineering days in a period between April 1 and April 10, 2025.<\/p>\n
A second, fix review was then performed on April 24 2025.<\/p>\n
We began our review by understanding the protocol\u2019s design and architecture. During this initial phase, we gathered all available information, including documentation, web page functionality, and project intentions.<\/p>\n
In the second phase, we performed a manual review and wrote fuzz tests side by side. This process helped us better understand the project\u2019s source code while implementing the fuzz tests. During the manual review, we dove deeper into the functionality of the code, simultaneously writing proof-of-concept tests to support our thoughts and test the correctness of instructions.<\/p>\n
During this phase we paid special attention whether:<\/p>\n
The final stage consisted of writing invariant checks. For fuzz testing, we used the Trident<\/span><\/a> fuzzing framework. The framework is designed for fuzz testing Solana programs written using the Anchor framework. During fuzzing, we identified the L1 issue<\/span>, where the refund recipient in some of the instructions lacks writable privileges, resulting in situations where instruction execution becomes problematic.<\/p>\n The first audit was performed on commit The fix review was performed on commit The classification of a security finding is determined by two ratings: <\/span>impact<\/b> and <\/span>likelihood<\/b>. This two-dimensional classification helps clarify the severity of individual issues. Issues which would be rated as <\/span>medium<\/span><\/i> severity, but which would be likely discovered only by the team, are typically decreased by the likelihood factor to the W<\/em><\/span>arning<\/span><\/i> or I<\/em><\/span>nformational<\/span><\/i> severity ratings.<\/span><\/p>\n Our review resulted in 9 findings, ranging from Info to Low severity. The most severe finding L1<\/span> reveals the possibility of instruction failure due to improper refund recipient writable privileges. All issues have been either fixed or acknowledged by the client.<\/p>\n The second security review was limited to issues found in the first security review and no other code changes were audited.<\/p>\n No critical severity issues were found.<\/p>\n <\/p>\n No critical severity issues were found.<\/p>\n <\/p>\n No critical severity issues were found.<\/p>\n <\/p>\n L1: Insufficient mutability for refund recipient<\/p>\n <\/p>\n W1: Second-level domain can be blocked forever<\/p>\n W2: Possibility of losing W3: Expiration does not sufficiently limit the second-level domain updates<\/p>\n W4: Record values are not fully overwritten<\/p>\n W5: Insufficient top-level domain validation<\/p>\n <\/p>\n I1: Unnecessary space allocation for the I2: Unnecessary source code<\/p>\n I3: InitSpace macro can be used instead of literal values<\/p>\n <\/p>\n The protocol implements, to some extent, a Role-based Access Control (RBAC) mechanism. The roles are:<\/p>\n User must trust:<\/p>\n Ackee Blockchain Security recommends Unstoppable Domains to:<\/p>\n Ackee Blockchain Security<\/a>\u2019s full Unstoppable Domains audit report can be found here<\/a><\/b>.<\/b><\/p>\n We were delighted to audit Unstoppable Domains and look forward to working with them again.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":" The Unstoppable Domains protocol allows the creation and management of domains on the Solana blockchain. These can be top-level domains, and can also have second-level domains. Second-level domains are in the form of non-fungible tokens (NFTs) minted to the users. Only one domain name can be in circulation. Unstoppable Domains engaged Ackee Blockchain Security to perform a security review of Web3 Domains…<\/p>\n","protected":false},"author":30,"featured_media":1051,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,5,113],"tags":[21,89,6,151],"class_list":["post-1050","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-solana","category-trident","tag-audit","tag-audit-summary","tag-solana","tag-unstoppable-domains"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/06\/unstoppable-blog-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/06\/unstoppable-blog-600x600.png","author_info":{"display_name":"Tom\u00e1\u0161 Kova\u0159\u00edk","author_link":"https:\/\/ackee.xyz\/blog\/author\/tomas-kovarik\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1050","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=1050"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1050\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/1051"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=1050"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=1050"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=1050"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}SCOPE<\/span><\/h2>\n
ab4cecd<\/code> and the scope was the following:<\/p>\n\n
844296e<\/code>.<\/p>\nFINDINGS<\/span><\/h2>\n
Critical severity<\/span><\/h3>\n
High severity<\/span><\/h3>\n
Medium severity<\/span><\/h3>\n
Low severity<\/span><\/h3>\n
Warning severity<\/span><\/h3>\n
ProgramAuthority<\/code> access<\/p>\nInformational severity<\/span><\/h3>\n
Tld<\/code> account<\/p>\nTRUST MODEL<\/span><\/h2>\n
\n
program authority<\/code><\/span> \u2013 apart from the smart contract upgrade authority, this is a role with the highest privileges (e.g. appointing new minters);<\/li>\nminter<\/code><\/span> \u2013 a role with the ability to mint new second-level domains, update domain metadata, modify the domain expiration, add and remove record before minting a domain.<\/li>\n<\/ul>\n\n
program authority<\/code> <\/span>to appoint responsible minters.<\/li>\n<\/ul>\nCONCLUSION<\/span><\/h2>\n
\n