Awesome Solana Security

Resources to help you build better and more secure Solana programs. Kept up to date.

Official Resources

• Solana docs
• Solana courses
• Solana cookbook
• Solana examples supporting multiple frameworks
• Solana bootcamp 2024
• SPL (Solana Program Library) docs: SPL is an official collection of programs to help you build your own Solana program.

Rust

If you need a primer on Rust, these resources are for you:

• Rust book
• Rust by example
• Rust cheatsheet

Solana Resources Using Native Rust

• Solana's native Rust docs
• Solana's native Rust course

Solana Resources Using Anchor Framework

We highly recommend using Anchor, a framework for building secure Solana programs.

• Anchor docs
• Anchor book
• Anchor by example
• Anchor wiki
• Anchor SPL wiki

Solana Resources for EVM transitioners

• RareSkills' Solana course for Ethereum developers
• 0xkowloon's Anchor for EVM developers
• S3v3ru5's Solana Beginner Notes

General Resources

• Ackee's Solana handbook

• Blueshift's Anchor and Pinocchio courses and challenges

• Rektoff's Security roadmap

• Helius's blog: Frequently publishes Solana-related content

• Pine Analytics's Substack: Focuses on deep diving into features of Solana protocols

• Infect3d's Essentials for Starting Solana Auditing

• Lucrative_Panda's highly detailed research article that covers all of Solana's security incidents

• r0bre's 100 Daily Solana Tips

• Accretion's Hidden IDL Instructions and How to Abuse Them

• Farouk ELALEM's explanation of how Solana programs work under the hood

• Ottersec's lamport transfers vulnerabilities

• Asymmetric Research's analysis of CPI vulnerabilities

• Alex Lazar's analysis of CPI vulnerabilities

• AlexAlekhinEth's high-level explanation of Solana network architecture

• Helius's complete history of Solana outages

• Exo Tech's guide for developers on creating auditor-friendly architecture documentation

• Solana's general common vulnerabilities:

  • Solana security course
  • Urataps's program examples with vulnerabilities
  • Helius's common vulnerabilities
  • ImmuneBytes's common Solana attack vectors
  • Slowmist's Solana best practices
  • Exvul's Solana security guide
  • Zigtur's Solana security walkthrough
  • M4rio's Solana security walkthrough
  • Nirlin's advanced Solana vulnerabilities

• Token-2022 Security resources:

  • Offside's Token-2022 best practices Part 1 and Part 2
  • Neodyme's Token-2022 security

Codebases to Study

Essential:

• Anchor framework
• Solana system program
• Solana token program
• Solana token-2022 program
• Solana ATA (Associated Token Account) program
• Solana token metadata program
• Metaplex's token metadata program

Optional:

• Raydium program: AMM protocol
• Kamino program: Lending protocol
• Squads program: Multisig protocol
• Solana Upgradeable BPF Loader program
• Solana Address Lookup Table program

Places to Ask Questions

• Solana Stack Exchange

Tools

• Solana playground
• Rust playground
• Sec3's IDL Guesser: Reverse engineers IDL from onchain programs for easier integration
• Trail of Bits's Anchor X-ray: Visualizes accounts in Anchor programs
• John Saigle's Anchor version detector: Helps figure out which versions of Rust, Solana, and Anchor are compatible with a given Anchor project.
• Ackee's Trident: Fuzzing framework for Solana
• Ackee's Solana IDE extension: Automatically detects common security issues in Solana programs and visualizes Trident fuzzing coverage

CTFs

• Ackee Solana CTF

Audit Contests

Solana security audits that are publicly available:

• Orderly on Sherlock: 2 High and 1 Medium
• WOOFi on Sherlock: 2 High and 3 Medium
• Pump Science on Code4rena: 2 High and 3 Medium
• Token22 Confidential Transfer on Code4rena: 7 Low
• Meteora on Code4rena: 2 Medium

NOTE: Contact 0xmorph in the Cantina Discord server to gain read access if you don't have it.

• Grass on Cantina: 13 High and 6 Medium
• Olas on Cantina: 2 High and 3 Medium
• Tensor on Cantina: 5 High and 10 Medium
• ZetaChain on Cantina: 6 High and 27 Medium (partial Solana scope)
• Inclusive Finance on Cantina: 45 High and 25 Medium (partial Solana scope)
• Reserve Index on Cantina: 10 High and 11 Medium
• Solayer on Cantina: 3 High and 6 Medium
• Genius on Cantina: 6 High and 4 Medium (partial Solana scope)

NOTE: First Flights are introductory audit challenges with smaller codebases, designed for beginners to practice finding vulnerabilities.

• RustFund first flight: 4 High and 3 Medium
• SSSwap first flight: 5 High and 4 Medium