solana-vulnerability-scanner

Scanning Solana programs for security vulnerabilities involves analyzing native Rust or Anchor code to identify weaknesses like arbitrary CPI and improper PDA validation. The scanner automatically locates the program code and reports findings with file references and severity.

Security vulnerabilities to check for in Anchor programs include arbitrary CPI, improper PDA validation, missing ownership checks, missing signer checks, sysvar spoofing, and improper instruction introspection. These six patterns cover critical account validation and interaction flaws.

You can audit both native Rust and Anchor Solana programs. The scanner analyzes on-chain program code and interaction patterns across both frameworks to surface security flaws and assign severity levels.

PDA validation in Solana security audits checks that program-derived addresses are verified correctly to prevent unauthorized access. The scanner identifies improper PDA validation patterns and provides recommended fixes and testing strategies to harden the program.

Detecting missing signer checks is best handled by automated scanning that analyzes instruction logic and account validation flows. The scanner flags instances where signer verification is absent and provides remediation guidance to fix the vulnerability.

The Solana vulnerability scanner provides recommended fixes and testing strategies for identified issues. Findings include structured vulnerability reports with file references, severity assignments, and actionable mitigations to harden Solana programs.