Blog
Field notes for people shipping Rust and Anchor programs — the vulnerability classes that actually drain vaults, why they happen, and the constraints that stop them. Every post has vulnerable code next to the fix.
A seven-step review pass over an Anchor codebase — instruction authority, the escape hatches that disable Anchor's automatic checks, account constraints, CPIs, arithmetic and account lifecycle — ending in a checklist you can paste into your review notes.
The eight mistakes behind most Solana exploits — missing signer and owner checks, type cosplay, PDA seed and bump errors, arbitrary CPIs, integer overflow, duplicate mutable accounts and account revival — each with vulnerable and fixed Anchor code.
In the works
Solana vs Ethereum Smart Contract Security: What's Actually Different
Why an EVM security checklist won't protect a Solana program.
Missing Signer and Owner Checks: The Solana Bug That Drains Vaults
A deep dive into the two most expensive Solana vulnerabilities, with real attack scenarios.
Solana PDA Security: Seeds, Bumps, and the Mistakes That Bite
Non-canonical bumps, unvalidated seeds and unsafe signing — with Anchor fixes.
Want these checks running on your repo?
VaultLint is an AI security linter for Solana programs. Join the waitlist for early access.
Get early access