solana-security

Solana Security (Sealevel)

Scope

Use this skill for:

• Solana program auditing (Anchor/native)
• Solana account model pitfalls
• Solana-focused fuzzing / tooling / security references

Key Concepts

• Account model (mutable accounts, ownership, rent/exempt)
• Program Derived Addresses (PDA) and seeds
• Cross-Program Invocation (CPI) security
• Signer vs authority checks
• Serialization, discriminators, and account layout assumptions

Common Bug Classes

• Missing signer/authority validation
• Incorrect PDA derivation or seed collisions
• CPI to untrusted programs
• Account confusion (wrong account passed, mismatched owner)
• Arithmetic / precision issues in token math

Tooling

• Anchor framework and security patterns
• Fuzzers / harnesses (e.g., Trident)
• Program analyzers and disassemblers

Where to Add Links in README

• Solana SDKs/tools: Development → SDK / Development → Tools
• Solana audit checklists: Security
• Solana learning guides: Blockchain Guide

Rules

• Use English descriptions
• Avoid duplicates across categories