Skip to content
This repository has been archived by the owner on Nov 26, 2024. It is now read-only.

Latest commit

 

History

History
86 lines (50 loc) · 2.94 KB

10_security.md

File metadata and controls

86 lines (50 loc) · 2.94 KB

🛹 Writing Secure Programs on Solana


👉🏼 Solana security overview

👉🏼 Security security resources


Common Security Exploits


Missing Address Check

  • Make sure that an account has the expected address (pubkey).
  • For example, verifying that an admin account is associated with the config account using the constraint has_one = admin.

Missing Ownership Check

  • Verify that an account is owned by the expected program by using Anchor's Account<info, T>type that checks the owner (instead ofAccountInfo<info>).

Missing Signer Check

  • This vulnerability occurs when an account is not signed so anyone who knows the user pubkey can use it in a transaction.
  • A solution is to replace AccountInfo<'info> with Signer<'info>.

Exploiting Arbitrary CPI

  • Verify that the target program to be invoked has the correct address.
  • For example, if the main program invokes an external program to transfer funds from a user account to a pool account and the program does not verify the address of the external program, an arbitrary code execution can happen.
  • To mitigate, replace the AccountInfo<'info> type (which is unverified) with Anchor's Program<'info, T> type.
  • Note that Anchor supports System, Token, and AssociatedToken programs, but other programs must have the CPI modules generated.
  • To learn more, check out soldev.app's lesson on Arbitrary CPI.

Math & Logic Issues

  • Beware of arithmetics and precision issues.
  • Validate account data and instruction parameters.
  • Make sure instructions are executed in the correct order.
  • Make sure to prevent unintended behavior when passing duplicated accounts.

Reinitialization and Revival Attacks


PDAs

  • Use canonical bump to avoid multiple valid PDAs (never let the user define an arbitrary bump).
  • Do not share global PDA authorities; instead, use account-specific PDAs.
  • To learn more, check out soldev.app's lesson on Bump Seed Canonicalization.

Security security resources