A comprehensive guide to real-world Solana security vulnerabilities with side-by-side vulnerable and secure implementations in Anchor.
This repository teaches security through contrast. Each example shows:
- ❌ A vulnerable implementation that mirrors real exploits
- ✅ A secure implementation with proper protections
- 📝 Detailed explanations of the vulnerability and fix
- 🧪 Tests demonstrating both the exploit and the protection
Severity: Critical | Real-world impact: Millions lost
The vulnerability where an attacker can inject malicious program IDs into Cross-Program Invocations, executing arbitrary code with your program's authority.
What you'll learn:
- Why program ID validation matters in CPI
- How to properly validate program accounts
- The difference between account owner checks and program checks
Severity: High | Real-world impact: State manipulation attacks
A subtle vulnerability where account state changes between validations aren't detected, allowing attackers to manipulate program logic.
What you'll learn:
- The dangers of multiple account deserialization
- How Solana's account borrowing model affects security
- Proper patterns for account state consistency
Severity: High | Real-world impact: Unauthorized token transfers
The misunderstanding of SPL Token's delegate authority model that allows attackers to drain tokens even after "revoked" approvals.
What you'll learn:
- The difference between owner and delegate authority
- Proper delegate validation patterns
- When to zero out delegate vs check both owner and delegate
Severity: Medium | Real-world impact: Logic bypass
Attackers can pass fake sysvar accounts (Clock, Rent, etc.) to manipulate program logic that relies on system state.
What you'll learn:
- Why sysvar address validation is critical
- Proper patterns for using Clock, Rent, and other sysvars
- The difference between runtime and compile-time sysvar access
Severity: Critical | Real-world impact: Account takeover
A vulnerability where initialization instructions can be called multiple times, allowing attackers to reset account state or claim ownership.
What you'll learn:
- The init constraint vs manual initialization
- Proper use of the init_if_needed constraint (and its dangers)
- How to prevent re-initialization attacks
# Install dependencies
npm install
# Build all programs
anchor build
# Run all tests
anchor test
# Run specific example tests
anchor test -- --features cpi-secure- Start with the README in Project directory - It explains the vulnerability context
- Read the vulnerable implementation - Understand what's wrong
- Study the secure implementation - Learn the proper pattern
- Run the tests - See the exploit in action and how the fix prevents it
- Review inline comments - Every critical line is explained
Beginners: Start with examples 4 → 5 → 1
Intermediate: Focus on examples 2 → 3
Advanced: Study the subtle differences in test files
The vulnerable code in this repository is intentionally broken. Never use vulnerable implementations in production. They exist solely for educational purposes.
SuperteamNG Solana Security Bounty - Demonstrating real-world vulnerabilities that have caused actual exploits, not just theoretical issues.
MIT - Use freely for learning and teaching
Remember: Security is not about memorizing patterns—it's about understanding why something is dangerous.