Registry / Kamino Farms Program
Report card · DeFi
Kamino Farms Program
Kamino's farming program for staking positions and rewards.
FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr
Fuzzy ScoreFuzzy Score, 0 to 100: the lower of Depth (how hard Fuzzy tried) and a cap set by the worst proven finding.34Shallow runShallow run: nothing was proven, but Depth is under 50, so Fuzzy did not get far enough to say much. It is not a judgment that the program is broken.Depth 34 · cap 100Scanned November 9, 2026 at 10:00 PM UTC
CertificationDevnet certification only: a jury of registered Verafy harnesses ruled on the report on Solana devnet. Its jurors voted by script, and only the Sniffed level is possible today. Not a full certification.
Devnet certification only: Sniffed
A jury of 4 registered Verafy harnesses from 4 model families ruled on this report on Solana devnet, and verafy_certification wrote the level for this exact build on November 9, 2026 at 9:28 PM UTC. This is not a full certification: the jurors voted by script in this run, it lives on devnet, and a Sniff run can earn Sniffed at most. The jury ruled on the scan from November 9, 2026 at 9:28 PM UTC; the report below may be a newer scan of the same build.
- Certification account
- 8WPWh1Mjcxk3att6nwsDgtKGPexHWEKoj2LedFi9GzBf
- Jury ruling
- D1tms8kBn4TfGuAcg8oWMNYv9CJ45frg6NYThAaNopse
- Certify transaction
- nzmRDjF9L9JdqBwwLvsPN9ABRstH6spu…
- Bytecode hash
- 766533347d1e477537185192a8018962150898d457a0e4e98c0c5a2ba9133afd
- Report hash
- 930dfee622d3e6c5d4c83dd270a6d9b9e24a70919fa9d5f101a5810a7b4f91d7
What ran
A Sniff run: 125 transactions in 12 seconds, 4 attack classes run, tested on mainnet replay (accounts cloned at slot 467477141). Nothing was sent to mainnet or devnet. How a run works
| Assessment | Result | What it means here | Based on |
|---|---|---|---|
| Missing signer check | held | Tried, and every attack in this class failed. | Sealevel Attacks (Coral, the Anchor team) |
| Missing owner check | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Solana Foundation course: Owner Checks |
| Account substitution | held | Tried, and every attack in this class failed. | Sealevel Attacks (Coral, the Anchor team) |
| PDA seed collision | does not apply | Nothing in this program's interface this class can target. | Sealevel Attacks (Coral, the Anchor team) |
| Arithmetic overflow | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Close, then reuse | not built yet | This class applies, but this engine version does not run it yet. | Sealevel Attacks (Coral, the Anchor team) |
| Unchecked CPI target | not built yet | This class applies, but this engine version does not run it yet. | Solana Foundation course: Arbitrary CPI |
| Unchecked mint or authority | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Lamport draining | held | Tried, and every attack in this class failed. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Reinitialization | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Solana Foundation course: Reinitialization Attacks |
| Price manipulation | not built yet | This class applies, but this engine version does not run it yet. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Compute exhaustion | held | Tried, and every attack in this class failed. | Solana docs: fees and compute budget |
Depth: 34 of 100
| Part | Points | Measured as |
|---|---|---|
| Branch coverage | 0 / 40 | Share of the program's branches executed. Not measured yet. |
| Instructions driven | 7 / 20 | Share of instructions driven to both success and failure. |
| Attack classes tried | 7 / 20 | Share of the classes that apply to this program that actually ran. |
| Real state | 10 / 10 | 10 for cloned mainnet accounts, 5 for accounts built from the IDL, 0 for none. |
| Effort | 10 / 10 | Share of the planned run completed within the time limit. |
Instructions
Fuzzy first calls each instruction the way an honest user would. Only instructions that complete an honest call can be attacked.
unstake: ranwithdrawUnstakedDeposits: did not completeharvestReward: did not complete
Findings and leads
No proven findings. 2 leads: attacks that did something unexpected but did not prove theft. Leads never count toward the score.
Missing signer check: 2
Source and dependencies
Verified buildThe deployed bytecode was rebuilt from Kamino-Finance/kfarms at commit
bfa186034b.Source: OtterSec verification service, last verified Sep 3, 2026.
271 crates in the verified commit's Cargo.lock: 11 with a vulnerability advisory, 12 with a warning (unmaintained or unsound). The lockfile covers the whole repository, so some of these sit in off-chain tools or tests rather than the deployed program. Advisories are leads for the team, not proven exploits, and never change the score.
| Crate | Advisory | Kind | Fixed in |
|---|---|---|---|
| atty 0.2.14 | RUSTSEC-2021-0145 atty potential unaligned read | vulnerability | no fix |
| borsh 0.9.3 | RUSTSEC-2023-0033 Parsing borsh messages with ZST which are not-copy/clone is unsound | vulnerability | 1.0.0-alpha.1 |
| borsh 0.10.3 | RUSTSEC-2023-0033 Parsing borsh messages with ZST which are not-copy/clone is unsound | vulnerability | 1.0.0-alpha.1 |
| crossbeam-epoch 0.9.15 | RUSTSEC-2026-0204 Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid | vulnerability | 0.9.20 |
| curve25519-dalek 3.2.1 | RUSTSEC-2024-0344 curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub` | vulnerability | 4.1.3 |
| ed25519-dalek 1.0.1 | RUSTSEC-2022-0093 `ed25519-dalek` Double Public Key Signing Function Oracle Attack | vulnerability | 2.0.0 |
| keccak 0.1.4 | RUSTSEC-2026-0012 Unsoundness in opt-in ARMv8 assembly backend for `keccak` | vulnerability | 0.1.6 |
| rand 0.7.3 | RUSTSEC-2026-0097 Rand is unsound with a custom logger using rand::rng() | vulnerability | 0.9.3, 0.10.1, 0.8.6 |
| rand 0.8.5 | RUSTSEC-2026-0097 Rand is unsound with a custom logger using rand::rng() | vulnerability | 0.9.3, 0.10.1, 0.8.6 |
| serde_with 2.3.3 | GHSA-7gcf-g7xr-8hxj serde_with: KeyValueMap serialization panics on empty sequence or map entries | vulnerability | 3.21.0 |
| zerocopy 0.7.25 | RUSTSEC-2023-0074 Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut | vulnerability | 0.2.9, 0.3.2, 0.4.1 |
| anyhow 1.0.75 | RUSTSEC-2026-0190 Unsoundness in `Error::downcast_mut()` | unsound | 1.0.103 |
| atty 0.2.14 | RUSTSEC-2024-0375 `atty` is unmaintained | unmaintained | no fix |
| bincode 1.3.3 | RUSTSEC-2025-0141 Bincode is unmaintained | unmaintained | no fix |
| bitmaps 2.1.0 | RUSTSEC-2026-0247 bitmaps is unmaintained | unmaintained | no fix |
| derivative 2.2.0 | RUSTSEC-2024-0388 `derivative` is unmaintained; consider using an alternative | unmaintained | no fix |
| im 15.1.0 | RUSTSEC-2023-0126 Aliasing violation in `OrdSet` insertion | unsound | no fix |
| im 15.1.0 | RUSTSEC-2026-0248 im is unmaintained | unmaintained | no fix |
| libsecp256k1 0.6.0 | RUSTSEC-2025-0161 libsecp256k1 is unmaintained | unmaintained | no fix |
| memmap2 0.5.10 | RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2` | unsound | 0.9.11 |
| paste 1.0.14 | RUSTSEC-2024-0436 paste - no longer maintained | unmaintained | no fix |
| sized-chunks 0.6.5 | RUSTSEC-2026-0251 sized-chunks is unmaintained | unmaintained | no fix |
| sized-chunks 0.6.5 | RUSTSEC-2026-0255 Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free) | unsound | no fix |
Source: OSV, which includes the RustSec advisory database.
Gaps in this run
- 2 of 3 instructions never completed an honest call, so there was no working path to attack from: withdrawUnstakedDeposits, harvestReward.
- Built attack classes that apply but did not run: Missing owner check, Arithmetic overflow, Unchecked mint or authority, Reinitialization.
- Attack classes that apply but are not built yet: Close, then reuse, Unchecked CPI target, Price manipulation.
- Branch coverage is not measured in this engine version (0 of 40 Depth points).
- The program is upgradeable, so this report and any certification cover only the build hashed below.
Planned add-ons not run on this program yet: rebuild from source, static lints, deep fuzz, property fuzzing, ai design review, kitchen sink.
The build
- Bytecode SHA-256
- 67c4a989342024efedf6181c1d91cf6aac2bb2bcd17f43b8848c9f3d8ba21011
- Size
- 10240 KB
- Upgradeable
- Yes
- Upgrade authority
- CivjSDKgTpmkRNL4zYcmv9D9QqPJg6yTxBVxMGcXvMuY
- Anchor IDL
- Yes, 27 instructions
- Engine
- fuzzy-engine/0.2.0 · Sniff
For agents
GET https://fuzzy.verafy.ai/api/registry?program=FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr GET https://fuzzy.verafy.ai/api/certification?program=FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr
Or use the Fuzzy MCP server. Docs