solana-vulnerability-scanner

To audit a Solana smart contract, you scan native Rust or Anchor program sources to identify critical security weaknesses in account validation, PDA usage, and CPI safety. This generates a vulnerability report with severity, file locations, and mitigation steps.

Common PDA validation and CPI security flaws include arbitrary CPI, improper PDA seed and bump correctness, missing ownership checks, and missing signer enforcement. These vulnerabilities allow account spoofing and unauthorized cross-program invocations before deserialization.

You check for missing signer and sysvar spoofing issues by scanning for owner and signer checks before deserialization, verifying checked sysvar loaders, and ensuring proper correlated instruction indexing. This detects spoofing and unauthorized instruction introspection.

Yes, you can use automated vulnerability scanning for both native Rust and Anchor Solana code. The scanner applies to native Rust and Anchor-based workflows, reviewing cross-program invocations, PDA implementations, and instruction parsing logic.

The best way to review cross-program invocations for arbitrary CPI risks is exhaustive pattern detection across invoke and invoke_signed calls. This identifies unsafe execution paths and produces actionable remediation with testing guidance.

Yes, Solana vulnerability scanning detects improper instruction introspection and correlated instruction indexing issues. It evaluates instruction parsing logic to ensure secure execution and produces findings with concrete mitigation steps.