Accretion is a boutique security firm with an exclusive focus on the Solana runtime. We audit Solana programs — Anchor, Pinocchio, and native — and nothing else. Since January 2025, our full-time, Solana-only audit practice has reviewed 70+ protocols protecting over $3B in TVL, including Light Protocol, MetaDAO, marginfi, Sanctum, Ellipsis Labs, Realms, Metaplex, and the Solana Foundation.
This repository contains every audit report our clients have chosen to make public. Many engagements are private and not listed here.
Looking for an audit? Submit your protocol at accretion.xyz or email contact@accretion.xyz — we respond within 24 hours. We can start an audit immediately, and every engagement includes six months of post-audit support with 24/7 emergency response for critical issues.
Our reports cover the full Solana attack surface: account validation, PDA derivation and seeds, CPI safety, arithmetic and rounding, oracle usage, token program interactions (SPL Token and Token-2022), upgrade authority and admin risk, and protocol-specific economic logic. We audit programs written with Anchor, Pinocchio, and raw solana-program.
| ID | Protocol | Category | Framework | Date | Website | Report |
|---|---|---|---|---|---|---|
| A24VAU1 | The Vault Directed Stake | Liquid staking | Anchor | 2024 | thevault.finance | |
| A24LIG1 | Light Protocol | ZK compression | Anchor | 2024 | lightprotocol.com | |
| A25LIG1 | Light Protocol | ZK compression | Anchor | January 2025 | lightprotocol.com | |
| A25MET1 | MetaDAO Launchpad | Governance / launchpad | Anchor | March 2025 | metadao.fi | |
| A25BEA1 | Beans Dot Fun | Consumer | Anchor | March 2025 | beans.fun | |
| A25MRG1 | marginfi | Lending | Anchor | April 2025 | marginfi.com | |
| A25LIG2 | Light Protocol (Batched Merkle Trees) | ZK compression | Anchor | April 2025 | lightprotocol.com | |
| A25LIG3 | Light Protocol | ZK compression | Anchor / Pinocchio | May 2025 | lightprotocol.com | |
| A25ELL1 | Ellipsis Plasma / Gavel | AMM (sandwich-resistant) | Native | May 2025 | gavel.xyz | |
| A25REA1 | Realms (Versioned Transactions) | Governance | Native | May 2025 | realms.today | |
| A25ANA2 | Swig | Smart wallet | Pinocchio | June 2025 | onswig.com | |
| A25MRG2 | Project 0 / mrgn (Kamino integration) | Lending | Anchor | June 2025 | 0.xyz | |
| A25MET2 | MetaDAO Squads Integration | Governance / treasury | Anchor | July 2025 | metadao.fi | |
| A25PRC1 | Privacy Cash | ZK privacy | Anchor | July 2025 | privacycash.org | |
| A25MET3 | MetaDAO Price-Based Token Unlocks | Governance / launchpad | Anchor | September 2025 | metadao.fi | |
| A25SAN1 | Sanctum Jiminy, Token Ratio, FlatSlab | Liquid staking (LST) | Jiminy | September 2025 | sanctum.so | |
| A25MRG3 | Project 0 / mrgn (Drift & Solend integration) | Lending | Anchor | September 2025 | 0.xyz | |
| A25REA2 | Realms Metaplex Core NFT Plugin | Governance / NFT | Anchor | September 2025 | realms.today | |
| A25HYL1 | Hylo | Stablecoin / leverage | Anchor | December 2025 | hylo.so | |
| A25PRC2 | Privacy Cash SPL Token | ZK privacy | Anchor | December 2025 | privacycash.org | |
| A26SFR1 | Lazorkit | Passkey wallet | Pinocchio | January 2026 | github.com/lazor-kit | |
| A25SFR2 | Solana Token ACL | Token infrastructure | Native | January 2026 | solana-foundation/token-acl | |
| A25TES1 | Tessera Token & Referral | Token / referral | Anchor | January 2026 | tessera.pe | |
| A25MAT1 | Matrixdock XAUm RWA Contracts | RWA (tokenized gold) | Anchor | January 2026 | matrixdock.com/xaum | |
| A26MET1 | MetaDAO (Full Audit) | Governance / futarchy | Anchor | February 2026 | metadao.fi | |
| A26SFR2 | Solana Keychain | Key management | Rust / TypeScript | February 2026 | solana-foundation/solana-keychain | |
| A25SFR4 | Solana Token ACL Gate | Token infrastructure | Pinocchio | February 2026 | solana-foundation/token-acl-gate | |
| A25SAN2 | Sanctum INF V2 | Liquid staking (LST) | Jiminy | February 2026 | sanctum.so | |
| A26HTO1 | RevTec V2 | DePIN | Anchor | March 2026 | revtec.fi | |
| A25LIG5 | Light Protocol Compressed Token Program V2 | ZK compression | Pinocchio | March 2026 | lightprotocol.com | |
| A26SFR3 | Solana Foundation Escrow | Token infrastructure | Pinocchio | April 2026 | solana-program/escrow | |
| A26YOL1 | YO Protocol | Yield aggregator | Anchor | April 2026 | yo.xyz | |
| A26MAN1 | Manifest Destiny | Orderbook DEX | Pinocchio | May 2026 | manifest.trade | |
| A26EXP1 | Exponent Tranching | Fixed yield / tranching | Anchor | May 2026 | exponent.finance | |
| A26SFR4 | Solana Foundation Token ACL Gate Updates | Token infrastructure | Pinocchio | June 2026 | solana-foundation/token-acl-gate | |
| A26HYL1 | Hylo V2 Exchange, Earn Pool & Router | Stablecoin / leverage | Anchor | July 2026 | hylo.so |
Each report has a stable ID of the form A<YY><CLIENT><N> — audit year, client code, and engagement number. Repeat IDs across years (e.g. A25LIG1 … A25LIG5) indicate long-term engagements: several of our clients, including Light Protocol and MetaDAO, have returned for four or more audits.
- Website: accretion.xyz
- Research blog: accretion.xyz/blog — Solana security research, new bug classes, and field guides
- X / Twitter: @accretion_xyz
- Tooling: Solana Data Reverser — reverse engineer Solana account data without source code
- Contact: contact@accretion.xyz
Our researchers have prevented 50+ critical exploits across the Solana ecosystem. We regularly discover vulnerabilities in previously audited protocols and publish new bug classes to raise the ecosystem's security bar.