solana-vulnerability-scanner

Scan the program for six critical patterns: arbitrary CPI, improper PDA validation, missing ownership checks, missing signer checks, sysvar spoofing, and improper instruction introspection. Use ripgrep to locate invoke calls, PDA derivations, and account deserializations, then verify each against the validation checklist.

Arbitrary CPI occurs when a program calls invoke() or invoke_signed() with a user-controlled program ID without validating it first. An attacker can substitute a malicious program that impersonates the intended one, such as a fake SPL Token program, to steal funds or bypass logic.

Yes, it covers both native Rust Solana programs using solana_program and Anchor framework programs using anchor_lang. For Anchor, it checks that Program<'info, T>, Account<'info, T>, and Signer<'info> types are used so validation happens automatically.

Use the seeds and bump constraints in the account attribute so Anchor validates the canonical bump automatically. In native programs, call find_program_address() instead of create_program_address() and compare the result against the provided account, storing the bump for reuse.

Before Solana 1.8.1, functions like load_instruction_at() did not validate the sysvar account, letting attackers pass spoofed sysvars to fake instruction data. On 1.8.1 and later, use the checked variants load_instruction_at_checked() and load_current_index_checked().

Pattern-based scanning cannot confirm exploitability or catch logic bugs outside the six encoded patterns. Findings should be verified with unit tests, Anchor integration tests using malicious inputs, and a local solana-test-validator deployment.