The Good, The Bad, and The Vulnerable: Navigating Common Pitfalls in Solana Program
summary
Ten concrete rules: always check signer and owner check on accounts, verify the program ID for CPIs, and tag account types with an 8‑byte identifier so mints and token accounts don’t get swapped. Use checked integer math, do multiplies before divides to preserve precision, and pick a consistent rounding policy (one‑token rounding leaks can be batched into profitable drains). Write a redeemed boolean before closing accounts to prevent reopen attacks, prefix PDA seeds to avoid collisions, handle CPI errors (no missing ?), and use Anchor and Solana Bank Run for validation and unit tests.
AI-written summary · about
chapters (9)
- 0:00Introduction to Solana security
- 1:01Signer and ownership checks
- 2:21Account validation and interaction
- 4:22Integer math best practices
- 7:20Precision and rounding errors
- 10:13Managing account lifecycle
- 12:28Error handling in Rust
- 13:53PDA seed security
- 16:38Tools and concluding thoughts
related talks
20mSolidity's most common security pitfalls and its best safeguards
30mSmart-Contract Security 201: Auditing Lessons for Solana Founders
20mLearning How to Build Secure Smart Contracts
28mSolidity Best Practices - 10 Tips
51mA Deal with the Devil: Breaking Smart Contracts
25mCommSec D2 - Smart Contract (In)Security
18mCross chain Intent + Account Abstraction Audit & Threat Modeling
43mOutsmarting Smart Contracts