Solana audits, account by account.
Senior manual review of your Anchor or native Solana program. Account validation, PDA logic, and CPI safety, paired with Trident-based fuzzing and our internal AI audit agents.
Solana’s power is its account model. So are its bugs.
Most Solana exploits come from one of three places: missing account validation, wrong signer checks, or an unsafe cross-program invocation. They’re subtle, and the framework only protects you from half of them. We read every account constraint and every CPI, and we fuzz the rest.
What’s in the audit.
Solana-specific risk classes
Anchor, native Solana, Trident, fuzzing
DeFi, NFT, infra, and L1 programs
Recent Solana engagements.
Fair Casino Solana Vault Program
Anchor program audit for a casino vault, focused on PDA derivation, deposit/withdraw flows, and authority controls.
Neptun Finance LBP Launchpad
Liquidity bootstrap pool audit covering bonding curve math, vesting, and the launch authority lifecycle.
Paragon DEX
DEX program audit on Solana — orderbook, AMM, and the matching engine. Account validation under cross-program invocation.
Scoped to your program.
Solana audits are sized to instruction count, account-graph complexity, and integration surface. No fixed packages. Talk to us for a scope and quote.
Questions.
We audit both. Anchor saves us time on the boilerplate (account constraints are encoded), so the review can go deeper into business logic. Native programs need more manual coverage of validation patterns.
Yes. We use Trident-based fuzzing for stateful property checks and invariant violations. Fuzz harnesses are delivered alongside the report.
CPI surface is a first-class scope item. We review the full set of inner instructions you invoke, the signer/PDA accounts you pass through, and what happens when the callee behaves adversarially.
Yes, including Token-2022 extensions (transfer hooks, transfer fees, confidential transfers, etc.). Token program integration is a common source of subtle bugs.
We review the Solana side of the bridge (the program) and the trust assumptions on the messenger (Wormhole, LayerZero, etc.). The off-chain relayer/keeper side is best paired with our Application security audit.
Two to four weeks of focused review by senior auditors, plus fix verification. Depends on program size, account complexity, and integration surface.
Go deeper.
Need something else?
Ready to audit?
Send us your program and a target date. We’ll come back with a scope and a quote within 24 hours.