Reentrancy guard on external-calling functions
Jupiter's assessment for RD-F-014 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Solana BPF programs use a different account model without ETH send callbacks making traditional EVM reentrancy guards inapplicable. Reentrancy via CPI cycles is auditable but requires source access. Closed-source binary prevents verification. OtterSec and Offside Labs audits would have covered this — but audit findings are inaccessible (PDF 404). Gray.
Sources #
- Curator noteprocess-learnings.md §Non-EVM / L1-nativeClosed-source binary; audit PDFs inaccessible; non-EVM reentrancy model differsretrieved 2026-04-29
Methodology #
Determine whether all state-mutating functions that perform external calls carry `nonReentrant` or an equivalent reentrancy guard.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol jupiter factor RD-F-014 score gray collected_at 2026-04-29 11:51:25