solana-security

Audit Solana programs by systematically reviewing instruction validation, account ownership checks, PDA derivation logic, cross-program invocations, and oracle data feeds. Use a structured five-step security review process with vulnerability checklists to identify exploitable weaknesses in Anchor or native Rust implementations and generate severity-rated reports with remediation guidance.

PDA derivation must use consistent seeds and bump constraints; CPIs require proper account ownership verification and instruction data validation. Review that PDAs cannot be spoofed, CPI signers are authorized, and no unexpected account modifications occur across program boundaries.

Yes, the security review framework applies to DeFi, NFT, governance, and other on-chain programs. The vulnerability pattern detection and architecture evaluation process works across Anchor and native Rust implementations regardless of program type.

Security reports include identified vulnerabilities with severity ratings, detailed remediation guidance for each issue, architecture and testing evaluation results, and recommendations for secure coding practices specific to your program's design and instruction patterns.

The framework covers both Anchor and native Rust Solana programs. While Anchor-specific guidance addresses framework conventions, the core security principles—instruction validation, account ownership, PDA safety, and CPI correctness—apply universally across both approaches.