sec3 (formerly Soteria)inCoinmonks·Jul 6, 2022Member-onlySecurity of Solana Smart Contracts: why you should always validate PDA Bump SeedsProgram derived addresses (PDAs) are used in virtually all Solana smart contracts. While excellent resources (e.g., the Solana Cookbook) exist for understanding PDAs, there is one important caveat deserving special attention: PDAs of a Solana program can have the same seeds with multiple valid bumps, giving multiple different addresses (quote…Solana Network5 min readSolana Network5 min read
sec3 (formerly Soteria)inCoinmonks·Jun 10, 2022Member-onlyOn DeFi Security: be careful of bi-directional roundingSec3 (formerly Soteria) has a team of top experts in security audits of smart contracts. In the last few months, we’ve observed an increasing number of vulnerabilities in DeFi applications that fall into a common pattern: bi-directional rounding: If a smart contract has a bi-directional function or functions (e.g., swap…Rounding Errors4 min readRounding Errors4 min read
BlockSec·Mar 27, 2022Secure the Solana Ecosystem (3) — Program Upgrade0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs 1. Overview In the previous blog, we introduced how to implement the cross-program invocation via function invoke and function invoke_signed. In this post, we will introduce another basic topic - Program Upgrade. 2. Deploy an Upgradable Program By default, all…Solana Network5 min readSolana Network5 min read
sec3 (formerly Soteria)inCoinmonks·Feb 28, 2022Member-onlyAnnouncing Soteria Premium: Auto Auditor for Solana Smart ContractsWe are glad to announce the first release of Soteria Premium: an auto- auditing service offered by Soteria team to scan a large list of security vulnerabilities in Solana smart contracts. Soteria Premium has a number of features: It detects 25+ types of common security vulnerabilities in Solana programs written…Audit5 min readAudit5 min read
Wormhole·Feb 4, 2022Wormhole Incident Report — 02/02/22On Feb 2, 2022, an attacker exploited a signature verification vulnerability in the Wormhole network to mint 120k Wormhole-wrapped Ether on Solana. These tokens were not backed by Ether deposits on the Ethereum side of the Portal bridge. …8 min read8 min read
