Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
SOL Omo audit found: None of the 174 order commitments of Solana AI trading agent matched its wallet signature
In a student audit of Omo, researchers found that the Solana (SOL) AI trading agent displayed a portfolio of more than $200,000, but none of its 174 order commitments matched transactions signed by its wallet.
Core Points
- A student researcher examined one of Omo's sealed decisions and found that the pairing transaction was a token transfer signed by another wallet.
- Omo's own public data shows that none of its 174 order commitments are linked to any transactions signed by the agent.
- The report calls for the use of a signature key held by hardware, although the author points out that the hardware solution cannot solve other failure issues with the agent.
Omo Audit Details
Charlie Sneed, a member of the University of Oregon Blockchain Club, published the paper on September 28 through a research competition hosted by hardware wallet maker Ledger. Ledger said it does not guarantee the correctness of Sneed's conclusions. Sneed began studying Omo a few days before Omo stopped trading and the website went offline, when its public dashboard showed that its asset portfolio was growing rapidly.
Omo went online on August 9 and traded Meme coins before August 31. Before each order is issued, it publishes an encrypted fingerprint of the reasoning process onto the Solana blockchain, and then publishes the text 20 minutes later so that anyone can compare it. Its documentation lists four inspection methods that outsiders can perform using hashing tools and public Solana servers without having to access Omo's systems. The fourth inspection requires confirmation whether the wallet issued by the agent signed the transaction. The project party stipulates that any transaction signed by other keys is unqualified. However, this inspection failed.
Sneed manually verified a commitment, the earliest record of a collateral transaction. The transaction paired with the decision made on August 21 was actually a token transfer signed by another wallet and sent to multiple addresses, including Omo, which did not include the purchase.
Sneed's views on keys
Sneed writes that the cryptographic mechanism itself is effective, every problem he finds is documented in Omo's code, and he sees no evidence of deliberate misleading. The zero-to-174 ratio data comes from Omo's own public data page. He believes the weakness lies in the custody aspect, because Omo uses keys extracted from mobile apps and stored on servers, and its transaction matching code never checks the signature.
Sneed提出了三项修复建议，首要建议是使用由代理控制并存储在硬件中的签名密钥，这正是Ledger所销售的产品类型。但他也对此主张进行了自我限制，指出硬件方案无法捕捉Omo 7.1%的低胜率，也无法阻止代理在网页搜索功能连续数天故障的情况下继续交易。
代理交易风险
今年，更多大型平台向交易代理开放了权限。Binance于8月20日允许AI代理进行交易，其产品副总裁Jeff Li表示，公司“确实无法看到”这些订单背后的推理逻辑。Robinhood在9月29日表示拥有超过150,000个代理账户，同时声明其不对代理进行监督或审计。而FINRA（美国金融业监管局）的2026年监管报告也将自主性和可审计性列为主要风险。
