Audit CPI usage in Rust-based Solana programs for security issues.
npx skills add https://github.com/PlamenTSV/plamen --skill cpi-security
Please help me install this Agent Skill. Skill: cpi-security Source: https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cpi-security Command: npx skills add https://github.com/PlamenTSV/plamen --skill cpi-security
This skill helps security auditors identify and reason about Solana CPI invocations to prevent misused cross-program calls.
Provide a simple Solana program snippet containing CPI usage and run the audit to see detected patterns.
High-intent search queries and answers about installing and using this skill.
To audit cross-program invocation calls in Solana programs, analyze invoke, invoke_signed, and CpiContext usage across program boundaries to surface security issues. Apply a seven-step checklist covering inventory, validation, signer tracing, and account reloads to produce actionable findings.
Security checks for Solana CPI usage require a seven-step checklist: inventory CPI calls, validate target program IDs, trace signers, check account reloads, verify lamports, perform owner post-CPI checks, and analyze call depth to surface vulnerabilities.
Tracing signer validation in Solana CpiContext involves analyzing invoke_signed calls to ensure proper PDA signing. The audit verifies that signer seeds are correctly validated and that unauthorized programs cannot bypass signer checks during cross-program invocations.
Yes, this CPI security audit works on Rust-based Solana programs. It detects invoke, invoke_signed, and CpiContext patterns in Rust source code and validates target program IDs to identify security issues in cross-program call implementations.
Solana programs fail owner checks after cross-program invocation when CPI calls modify account ownership without proper validation. The audit performs post-CPI owner checks to verify that account ownership remains valid and detects unauthorized ownership transfers.
The best way to detect CpiContext misuse in Solana programs is to enumerate all CPI targets and validate program IDs. This approach analyzes call depth and breadth to identify security issues in cross-program invocation patterns and generates actionable audit findings.
collat-labsScan Solana and Anchor programs for common security vulnerabilities.
andrescardonas7Scan Solana Rust programs for six critical security vulnerabilities.
tenequmGuide Solana program development with Anchor or native Rust.
rohanbhatia27Detect critical security vulnerabilities in Solana programs using Rust and Anchor.
