{"id":271,"date":"2022-07-22T12:00:42","date_gmt":"2022-07-22T10:00:42","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=271"},"modified":"2025-02-19T14:02:21","modified_gmt":"2025-02-19T12:02:21","slug":"neon-labs-spl-governance-contract-audit-summary","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/neon-labs-spl-governance-contract-audit-summary\/","title":{"rendered":"Neon Labs: SPL Governance Audit Summary"},"content":{"rendered":"

Neon Labs<\/a> engaged Ackee Blockchain<\/a>\u00a0to review and audit<\/a> their <\/span>SPL Governance contract between June 27 and July 22, 2022<\/strong>. The entire audit process was conducted with a total time commitment of 26 engineering days<\/a><\/strong>. We now publish a summary of our results.<\/p>\n

Methodology<\/b><\/h4>\n
\n
\n
\n

The beginning of the audit was dedicated to understanding the SPL Governance program.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

Reviewing the specifications, sources, and instructions provided to us is essential to ensure we understand the project’s size, scope, and functionality. This is followed by a detailed manual code review, which is the process of reading the source code line by line to identify potential vulnerabilities.\u00a0<\/span><\/p>\n

When the code review is complete, we run client’s tests to ensure the system works as expected and potentially write missing unit or fuzzy tests using our testing framework <\/span>Trdelnik<\/span><\/a>. We also deploy programs locally and try to attack and break the system.\u00a0<\/span><\/p>\n

Scope\u00a0<\/b><\/h4>\n

We audited commit <\/span>f13d7e7c1507819306797688ce0bb1f6950a5038 <\/em>of the neonlabsorg\/neon-spl-governance<\/a><\/span> repository, specifically programs<\/a>: maintanance\/program, addin-fixed-weights\/program, addin- vesting\/program, governance-lib<\/em>.<\/p>\n

During the security review<\/span>, we paid particular attention to the following questions:<\/span><\/p>\n