audit-solana

You are conducting a security audit for Solana programs. This is CRITICAL - take your time.

Related Skills

• security.md - Comprehensive security checklist
• programs/anchor.md - Anchor security patterns
• programs/pinocchio.md - Pinocchio security patterns
• testing.md - Fuzz testing with Trident

Pre-Audit Checklist

• All tests passing
• Code compiles without warnings
• Documentation complete
• No hardcoded keys or secrets

Step 1: Automated Analysis

echo "🔍 Running automated security analysis..."

# Dependency audit (check for known vulnerabilities)
echo "  📦 Checking dependencies..."
cargo audit

# Supply chain security (check for malicious dependencies)
if command -v cargo-geiger >/dev/null 2>&1; then
    echo "  ☢️  Checking unsafe code usage..."
    cargo geiger
fi

# Clippy with strict security lints
echo "  🔎 Running clippy security lints..."
cargo clippy --all-targets -- \
    -W clippy::all \
    -W clippy::pedantic \
    -W clippy::unwrap_used \
    -W clippy::expect_used \
    -W clippy::panic \
    -W clippy::arithmetic_side_effects \
    -D warnings

# Format check
echo "  📝 Checking format..."
cargo fmt --check

# Run full test suite
echo "  🧪 Running tests..."
if [ -f "Anchor.toml" ]; then
    anchor build && anchor test
else
    cargo build-sbf && cargo test
fi

echo "✅ Automated analysis complete"

Step 2: Account Validation Review

CRITICAL: Every account MUST be validated. Check each instruction:

Owner Checks

// ✓ CORRECT: Validate account owner
if *account.owner != expected_program_id {
    return Err(ProgramError::IncorrectProgramId);
}

// ✗ WRONG: Assuming owner without check

Signer Checks

// ✓ CORRECT: Verify signer
if !authority.is_signer {
    return Err(ProgramError::MissingRequiredSignature);
}

// ✗ WRONG: Privileged operation without signer check