Arbitrary call with user-controlled target
Jupiter Perpetual Exchange's assessment for RD-F-013 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
EVM-style arbitrary call(target, data) does not exist in Solana BPF; however, CPI in Solana does allow program invocations that may include user-influenced parameters. Without source access, CPI validation and allowlisting cannot be assessed. Gray: closed-source program, source not accessible.
Sources #
- Internal00-profile.md §8 and §9Closed-source program confirmed in profile §8; no public source repo in jup-ag org (185 repos searched)retrieved 2026-05-16
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol jupiter-perps factor RD-F-013 score gray collected_at 2026-05-16 01:53:11