Nirvana Finance

The set_debug_mode instruction has no signer validation, admin check, or any access control. Any user can call this to enable debug_mode on NirvCenter, unlocking all is_debug-gated privileged functions including minting, bond configuration, and more.

Any user can enable debug mode on a production deployment, unlocking privileged operations across the entire protocol. Combined with the missing admin check on mint_pre_ana, this enables arbitrary token minting and treasury draining.

Add a Signer account and admin access control check to set_debug_mode, consistent with all other admin functions in the protocol.

The mint_pre_ana handler is only gated by is_debug and does not include an admin access control check. The authority Signer is never validated against nirv_center.policy_owner. When debug mode is enabled (either legitimately or via C-1), any signer can mint unlimited prANA tokens. This contrasts with mint_nirv and mint_alms which both correctly require admin + is_debug.

An attacker mints arbitrary prANA, converts it to ANA via realize_pre_ana (paying floor price), then sells ANA at market price via the swap AMM. The difference between market and floor price is extracted from the treasury. With sufficient volume, the entire treasury can be drained.

Add admin access control check to mint_pre_ana handler.

The claim_lbp_rewards instruction checks commitment.target_spend_usd < history.net_spent_usd which rejects users who spent MORE than their target and allows users who spent LESS. The logic is inverted — users who didn’t meet their commitment target can claim rewards, while users who exceeded it are blocked.

Users can commit to a large spending target (earning a high reward rate), pay only the 1% escrow, spend nothing during bootstrap, and still claim the full prANA reward and escrow refund. This allows free extraction of prANA rewards and drains the USDC escrow.

Swap the comparison to reject users whose net spending is below their commitment target.

The config account in RewardByTime is missing the mut constraint. The handler modifies config.reward_index (via drop_prana_reward) and config.time_of_last_prana_reward, but since the account is not marked mutable, Anchor does not serialize these changes back. All modifications are silently discarded at the end of the instruction.

The public reward distribution mechanism is completely non-functional. ANA stakers never accumulate prANA rewards through the permissionless reward_by_time path. Only admin-called reward() works (which has mut). This breaks the core staking incentive mechanism, affecting all protocol participants.

Add mut constraint to config account in RewardByTime.

The BuybackAna instruction accepts an arbitrary mint_u with no constraint linking it to an expected money market or configuration. The treasury_u account is only validated as owner == nirv_center.key() and mint == mint_u.key(). A user can choose ANY mint for which nirv_center holds a treasury account, burn ANA, and receive ana_amount * floor_price worth of that token. The floor price is a protocol constant in USD terms, but there is no oracle price conversion for the chosen output token. If the protocol treasury holds high-value tokens (e.g., wBTC, SOL), a user could drain those at an incorrect 1:1-with-floor-price rate instead of the intended stablecoin payout.

An attacker can burn ANA and receive disproportionate value from treasury accounts holding non-stablecoin tokens, effectively draining the treasury of high-value assets at deeply discounted rates.

Validate that mint_u corresponds to an accepted money market mint by requiring a MoneyMarket account with PDA seeds verification, or constrain mint_u to a specific expected stablecoin mint stored in the config.

The money_market account in RealizePreAna is validated only with constraint = money_market.nirv_center == nirv_center.key() but lacks the seeds and bump constraint that would verify it is the correct PDA. The developer acknowledged this in a comment: ‘if there is more than one money market this might be spoofed’. In contrast, the same money_market account in swap.rs properly uses seeds = [b"mm1".as_ref(), treasury_token_account.mint.as_ref(), nirv_center.key().as_ref()], bump = money_market.bump. An attacker could substitute a different legitimate MoneyMarket account (one with for_prana = true but backed by a different, cheaper underlying token) to realize prANA at a lower effective cost, since the payment amount is calculated with hardcoded 6 decimals rather than using the money_market’s actual decimal configuration.

If multiple MoneyMarket accounts exist with for_prana = true, an attacker could pick the one with the most favorable terms to realize prANA, potentially paying less than intended by the protocol. The treasury_u constraint ties to money_market.token_account, so the substituted market’s treasury would receive funds in a potentially less valuable token while the user receives the same amount of ANA.

Add seeds and bump validation to the money_market account to ensure only the intended PDA can be used, matching the pattern used in swap.rs.