solana-vulnerability-scanner

Scan the program for six critical patterns: arbitrary CPI, improper PDA validation, missing ownership checks, missing signer checks, sysvar spoofing, and improper instruction introspection. Use ripgrep to locate invoke() calls, find_program_address usage, and account deserialization, then verify each has proper validation.

Arbitrary CPI occurs when a program calls invoke() or invoke_signed() with a user-controlled program ID without validation. An attacker can substitute a malicious program that impersonates the intended one, such as a fake token program that steals funds during a transfer.

Anchor prevents many issues when used correctly: Program<'info, T> validates program IDs, Account<'info, T> checks ownership, Signer<'info> enforces signatures, and seeds constraints validate PDAs. However, using raw AccountInfo with CHECK comments bypasses these protections.

Use find_program_address() to derive the canonical bump rather than accepting a user-provided bump with create_program_address(). In Anchor, use the seeds and bump constraints, and store the canonical bump in the account for reuse in invoke_signed calls.

Before Solana 1.8.1, functions like load_instruction_at() did not verify the sysvar account address, letting attackers pass spoofed sysvar accounts with fake instruction data. Version 1.8.1 introduced checked variants like load_instruction_at_checked() that validate the sysvar automatically.

Static pattern matching cannot confirm exploitability, detect business logic flaws, or reason about cross-program state at runtime. Findings should be verified with unit tests, integration tests using malicious inputs, and a local solana-test-validator environment.