README.md

Awesome Solana Security

Resources to help you build better and more secure Solana programs. Kept up to date.

Official Resources

• Solana docs
• Solana courses
• Solana cookbook
• Solana examples supporting multiple frameworks
• Solana bootcamp 2024
• SPL (Solana Program Library) docs: SPL is an official collection of programs to help you build your own Solana program.

Rust

If you need a primer on Rust, these resources are for you:

• Rust book
• Rust by example

Solana Resources Using Native Rust

• Solana's native Rust docs
• Solana's native Rust course

Solana Resources Using Anchor Framework

We highly recommend using Anchor, a framework for building secure Solana programs.

• Anchor docs
• Anchor book
• Anchor by example
• Anchor wiki
• Anchor SPL wiki

Solana Resources for EVM transitioners

• RareSkills' Solana course for Ethereum developers
• 0xkowloon's Anchor for EVM developers

General Resources

• Ackee's Solana handbook

• Blueshift's Anchor and Pinocchio courses and challenges

• Rektoff's Security roadmap

• Helius's blog: Frequently publishes Solana-related content

• Pine Analytics's Substack: Focuses on deep diving into features of Solana protocols

• Infect3d's Essentials for Starting Solana Auditing

• Lucrative_Panda's highly detailed research article that covers all of Solana's security incidents

• Solana security course

• r0bre's 100 Daily Solana Tips

• Accretion's Hidden IDL Instructions and How to Abuse Them

• Farouk ELALEM's explanation of how Solana programs work under the hood

• Ottersec's lamport transfers vulnerabilities

• Solana's general common vulnerabilities:

  • Urataps's program examples with vulnerabilities
  • Helius's common vulnerabilities
  • ImmuneBytes's common Solana attack vectors
  • Slowmist's Solana best practices
  • Exvul's Solana security guide
  • Zigtur's Solana security walkthrough
  • M4rio's Solana security walkthrough
  • Nirlin's advanced Solana vulnerabilities

• Token-2022 Security resources:

  • Offside's Token-2022 best practices Part 1 and Part 2
  • Neodyme's Token-2022 security

• Asymmetric Research's CPI vulnerabilities

Codebases to Study

Essential:

• Anchor framework
• Solana system program
• Solana token program
• Solana token-2022 program
• Solana ATA (Associated Token Account) program
• Solana token metadata program
• Metaplex's token metadata program

Optional:

• Raydium program: AMM protocol
• Kamino program: Lending protocol
• Squads program: Multisig protocol

Places to Ask Questions

• Solana Stack Exchange

Tools

• Solana playground
• Rust playground
• Sec3's IDL Guesser: Reverse engineers IDL from onchain programs for easier integration
• Trail of Bits's Anchor X-ray: Visualizes accounts in Anchor programs
• Trident - Fuzzing framework for Solana smart contracts with manually-guided testing, flow-based sequences, and property-based validation. Solana Foundation grant recipient.
• John Saigle's Anchor version detector: Helps figure out which versions of Rust, Solana, and Anchor are compatible with a given Anchor project.

CTFs

• Ackee Solana CTF

Audit Contests

Solana security audits that are publicly available:

• Orderly on Sherlock: 2 High and 1 Medium
• WOOFi on Sherlock: 2 High and 3 Medium
• Pump Science on Code4rena: 2 High and 3 Medium

NOTE: Contact 0xmorph in the Cantina Discord server to gain read access if you don't have it.

• Grass on Cantina: 13 High and 6 Medium
• Olas on Cantina: 2 High and 3 Medium
• Tensor on Cantina: 5 High and 10 Medium
• ZetaChain on Cantina: 6 High and 27 Medium (both Solidity and Solana are in-scope)
• Inclusive Finance on Cantina: 45 High and 25 Medium (both Solidity and Solana are in-scope)
• Reserve Index on Cantina: 10 High and 11 Medium