Program derived addresses (PDAs) are used in virtually all Solana smart contracts. While excellent resources (e.g., the Solana Cookbook) exist for understanding PDAs, there is one important caveat deserving special attention: PDAs of a Solana program can have the same seeds with multiple valid bumps, giving multiple different addresses (quote…

Sec3 (formerly Soteria) has a team of top experts in security audits of smart contracts. In the last few months, we’ve observed an increasing number of vulnerabilities in DeFi applications that fall into a common pattern: bi-directional rounding: If a smart contract has a bi-directional function or functions (e.g., swap…

0. Review Secure the Solana Ecosystem (1) — Hello Solana Secure the Solana Ecosystem (2) — Calling Between Programs 1. Overview In the previous blog, we introduced how to implement the cross-program invocation via function invoke and function invoke_signed. In this post, we will introduce another basic topic - Program Upgrade. 2. Deploy an Upgradable Program By default, all…

We are glad to announce the first release of Soteria Premium: an auto- auditing service offered by Soteria team to scan a large list of security vulnerabilities in Solana smart contracts. Soteria Premium has a number of features: It detects 25+ types of common security vulnerabilities in Solana programs written…

On Feb 2, 2022, an attacker exploited a signature verification vulnerability in the Wormhole network to mint 120k Wormhole-wrapped Ether on Solana. These tokens were not backed by Ether deposits on the Ethereum side of the Portal bridge. The attacker then bridged 93,750 of these tokens to Ethereum, withdrawing the…