Diggers
About the Protocol
Real-time multiplayer mining game backend and Solana reward program that pays SPL token rewards against signed receipts.
Findings (46)
32-bit mine world seed is brute-forceable offline from the join snapshot, leaking the real-money Ultimate Treasure coordinate
The mine world seed has only 32 bits of entropy, so a joining player can recover it offline from the join snapshot and locate the hidden Ultimate Treasure.
Deterministic non-revocable admin cookie plus mutable fee treasury lets a token-holder redirect all account-creation fees
The admin cookie is an unsalted SHA-256 of the admin token with no revocation, so a leaked or cracked token lets an attacker repoint account-creation fees to their own wallet.
Over-cap ore-sale settlements are minted claimable but revert on-chain, permanently destroying earned rewards
The backend never clamps ore-sale payouts to the on-chain per-receipt cap, so a large legitimate sale becomes a claimable settlement that always reverts on-chain.
Publicly-derivable treasure ReceiptClaim PDA lets anyone permanently brick a player's earned reward for 1 lamport (cross-layer)
The treasure ReceiptClaim PDA is derived from public data only, so anyone can pre-create it for 1 lamport and permanently block the player's reward claim.
Spoofable leftmost X-Forwarded-For lets a single host bypass every rate limit, including the admin-login throttle
Rate limits are keyed on the client-controlled leftmost X-Forwarded-For value, so rotating one header removes throttling from every protected route including admin login.
Ready to secure your project?
Get a free 30-minute security assessment. We’ll review your codebase scope and flag the top 3 risk areas.
No commitment required · Typical audits start within 1–2 weeks