solana-vulnerability-scanner

To audit Solana smart contracts for arbitrary CPI execution, scan Rust and Anchor source files for patterns enabling unauthorized cross-program invocations. The scanner identifies specific vulnerability code, reports severity with file locations, and provides targeted mitigations and test strategies.

Improper PDA validation in Anchor programs occurs when account derivation constraints are missing or bypassed. Detect it by scanning Anchor source code for missing ownership checks and insufficient signer verifications, which returns file-referenced findings with severity levels and actionable fixes.

Check Solana protocols for sysvar spoofing and missing signer checks by scanning native Rust and Anchor implementations for these specific vulnerability patterns. The scan reports exact file locations, assigns severity, and recommends concrete mitigations to validate account validation logic.

Yes, you can scan native Rust Solana code to find improper instruction introspection flaws. The scanner analyzes instruction-index logic and CPI security, reporting identified weaknesses with file references and providing tailored remediation approaches for both native and Anchor models.

Yes, the Solana vulnerability scanner works with both native Rust and Anchor frameworks. It applies account and constraint models specific to Anchor, while also analyzing native Rust implementations for missing access controls, PDA validation bypasses, and unsafe sysvar handling.

Automated Solana smart contract security audits are limited to detecting six specific vulnerability patterns like arbitrary CPI, PDA validation, and sysvar spoofing. They provide file-referenced findings and test strategies, but require manual review for complex business logic flaws outside these defined categories.