[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FJNEPQ17MNG7G473MATMZA":3,"skill-same:01M6FJNEPQ17MNG7G473MATMZA":58},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":31,"linkOnly":32,"markdownContent":33,"markdownBody":33,"frontMatter":34,"refName":35,"commitSha":36,"skillDirectory":37,"forksCount":38,"repositoryHtmlUrl":39,"repositoryHomepageUrl":40,"ownerHtmlUrl":41,"ownerBlogUrl":6,"ownerDescription":42,"updatedAt":43,"install":44,"resources":57},"01M6FJNEPQ17MNG7G473MATMZA","solana-vulnerability-scanner",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fsolana-vulnerability-scanner\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[26,27,28,29,30],"vulnerability","vulnerability scanner","scanner","solana","solana vulnerability scanner","2026-11-10 10:12:30",false,"# Solana Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Solana programs (native and Anchor framework) for platform-specific security vulnerabilities related to cross-program invocations, account validation, and program-derived addresses. This skill encodes 6 critical vulnerability patterns unique to Solana's account model.\n\n## 2. When to Use This Skill\n\n- Auditing Solana programs (native Rust or Anchor)\n- Reviewing cross-program invocation (CPI) logic\n- Validating program-derived address (PDA) implementations\n- Pre-launch security assessment of Solana protocols\n- Reviewing account validation patterns\n- Assessing instruction introspection logic\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Rust files**: `.rs`\n\n### Language\u002FFramework Markers\n```rust\n\u002F\u002F Native Solana program indicators\nuse solana_program::{\n    account_info::AccountInfo,\n    entrypoint,\n    entrypoint::ProgramResult,\n    pubkey::Pubkey,\n    program::invoke,\n    program::invoke_signed,\n};\n\nentrypoint!(process_instruction);\n\n\u002F\u002F Anchor framework indicators\nuse anchor_lang::prelude::*;\n\n#[program]\npub mod my_program {\n    pub fn initialize(ctx: Context\u003CInitialize>) -> Result\u003C()> {\n        \u002F\u002F Program logic\n    }\n}\n\n#[derive(Accounts)]\npub struct Initialize\u003C'info> {\n    #[account(mut)]\n    pub authority: Signer\u003C'info>,\n}\n\n\u002F\u002F Common patterns\nAccountInfo, Pubkey\ninvoke(), invoke_signed()\nSigner\u003C'info>, Account\u003C'info>\n#[account(...)] with constraints\nseeds, bump\n```\n\n### Project Structure\n- `programs\u002F*\u002Fsrc\u002Flib.rs` - Program implementation\n- `Anchor.toml` - Anchor configuration\n- `Cargo.toml` with `solana-program` or `anchor-lang`\n- `tests\u002F` - Program tests\n\n### Tool Support\n- **Trail of Bits Solana Lints**: Rust linters for Solana\n- Installation: Add to Cargo.toml\n- **anchor test**: Built-in testing framework\n- **Solana Test Validator**: Local testing environment\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Solana\u002FAnchor programs\n2. **Analyze each program** for the 6 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check account validation** and CPI security\n\n---\n\n## 5. Example Output\n\n---\n\n## 5. Vulnerability Patterns (6 Patterns)\n\nI check for 6 critical vulnerability patterns unique to Solana. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Arbitrary CPI** ⚠️ CRITICAL - User-controlled program IDs in CPI calls\n2. **Improper PDA Validation** ⚠️ CRITICAL - Using create_program_address without canonical bump\n3. **Missing Ownership Check** ⚠️ HIGH - Deserializing accounts without owner validation\n4. **Missing Signer Check** ⚠️ CRITICAL - Authority operations without is_signer check\n5. **Sysvar Account Check** ⚠️ HIGH - Spoofed sysvar accounts (pre-Solana 1.8.1)\n6. **Improper Instruction Introspection** ⚠️ MEDIUM - Absolute indexes allowing reuse\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Verify Solana program (native or Anchor)\n2. Check Solana version (1.8.1+ for sysvar security)\n3. Locate program source (`programs\u002F*\u002Fsrc\u002Flib.rs`)\n4. Identify framework (native vs Anchor)\n\n### Step 2: CPI Security Review\n```bash\n# Find all CPI calls\nrg \"invoke\\(|invoke_signed\\(\" programs\u002F\n\n# Check for program ID validation before each\n# Should see program ID checks immediately before invoke\n```\n\nFor each CPI:\n- [ ] Program ID validated before invocation\n- [ ] Cannot pass user-controlled program accounts\n- [ ] Anchor: Uses `Program\u003C'info, T>` type\n\n### Step 3: PDA Validation Check\n```bash\n# Find PDA usage\nrg \"find_program_address|create_program_address\" programs\u002F\nrg \"seeds.*bump\" programs\u002F\n\n# Anchor: Check for seeds constraints\nrg \"#\\[account.*seeds\" programs\u002F\n```\n\nFor each PDA:\n- [ ] Uses `find_program_address()` or Anchor `seeds` constraint\n- [ ] Bump seed stored and reused\n- [ ] Not using user-provided bump\n\n### Step 4: Account Validation Sweep\n```bash\n# Find account deserialization\nrg \"try_from_slice|try_deserialize\" programs\u002F\n\n# Should see owner checks before deserialization\nrg \"\\.owner\\s*==|\\.owner\\s*!=\" programs\u002F\n```\n\nFor each account used:\n- [ ] Owner validated before deserialization\n- [ ] Signer check for authority accounts\n- [ ] Anchor: Uses `Account\u003C'info, T>` and `Signer\u003C'info>`\n\n### Step 5: Instruction Introspection Review\n```bash\n# Find instruction introspection usage\nrg \"load_instruction_at|load_current_index|get_instruction_relative\" programs\u002F\n\n# Check for checked versions\nrg \"load_instruction_at_checked|load_current_index_checked\" programs\u002F\n```\n\n- [ ] Using checked functions (Solana 1.8.1+)\n- [ ] Using relative indexing\n- [ ] Proper correlation validation\n\n### Step 6: Trail of Bits Solana Lints\n```toml\n# Add to Cargo.toml\n[dependencies]\nsolana-program = \"1.17\"  # Use latest version\n\n[lints.clippy]\n# Enable Solana-specific lints\n# (Trail of Bits solana-lints if available)\n```\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Arbitrary CPI - Unchecked Program ID\n\n**Location**: `programs\u002Fvault\u002Fsrc\u002Flib.rs:145-160` (withdraw function)\n\n**Description**:\nThe `withdraw` function performs a CPI to transfer SPL tokens without validating that the provided `token_program` account is actually the SPL Token program. An attacker can provide a malicious program that appears to perform a transfer but actually steals tokens or performs unauthorized actions.\n\n**Vulnerable Code**:\n```rust\n\u002F\u002F lib.rs, line 145\npub fn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    let token_program = &ctx.accounts.token_program;\n\n    \u002F\u002F WRONG: No validation of token_program.key()!\n    invoke(\n        &spl_token::instruction::transfer(...),\n        &[\n            ctx.accounts.vault.to_account_info(),\n            ctx.accounts.destination.to_account_info(),\n            ctx.accounts.authority.to_account_info(),\n            token_program.to_account_info(),  \u002F\u002F UNVALIDATED\n        ],\n    )?;\n    Ok(())\n}\n```\n\n**Attack Scenario**:\n1. Attacker deploys malicious \"token program\" that logs transfer instruction but doesn't execute it\n2. Attacker calls withdraw() providing malicious program as token_program\n3. Vault's authority signs the transaction\n4. Malicious program receives CPI with vault's signature\n5. Malicious program can now impersonate vault and drain real tokens\n\n**Recommendation**:\nUse Anchor's `Program\u003C'info, Token>` type:\n```rust\nuse anchor_spl::token::{Token, Transfer};\n\n#[derive(Accounts)]\npub struct Withdraw\u003C'info> {\n    #[account(mut)]\n    pub vault: Account\u003C'info, TokenAccount>,\n    #[account(mut)]\n    pub destination: Account\u003C'info, TokenAccount>,\n    pub authority: Signer\u003C'info>,\n    pub token_program: Program\u003C'info, Token>,  \u002F\u002F Validates program ID automatically\n}\n\npub fn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    let cpi_accounts = Transfer {\n        from: ctx.accounts.vault.to_account_info(),\n        to: ctx.accounts.destination.to_account_info(),\n        authority: ctx.accounts.authority.to_account_info(),\n    };\n\n    let cpi_ctx = CpiContext::new(\n        ctx.accounts.token_program.to_account_info(),\n        cpi_accounts,\n    );\n\n    anchor_spl::token::transfer(cpi_ctx, amount)?;\n    Ok(())\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fsolana\u002Farbitrary_cpi\n- Trail of Bits lint: `unchecked-cpi-program-id`\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical (Immediate Fix Required)\n- Arbitrary CPI (attacker-controlled program execution)\n- Improper PDA validation (account spoofing)\n- Missing signer check (unauthorized access)\n\n### High (Fix Before Launch)\n- Missing ownership check (fake account data)\n- Sysvar account check (authentication bypass, pre-1.8.1)\n\n### Medium (Address in Audit)\n- Improper instruction introspection (logic bypass)\n\n---\n\n## 8. Testing Recommendations\n\n### Unit Tests\n```rust\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    #[test]\n    #[should_panic]\n    fn test_rejects_wrong_program_id() {\n        \u002F\u002F Provide wrong program ID, should fail\n    }\n\n    #[test]\n    #[should_panic]\n    fn test_rejects_non_canonical_pda() {\n        \u002F\u002F Provide non-canonical bump, should fail\n    }\n\n    #[test]\n    #[should_panic]\n    fn test_requires_signer() {\n        \u002F\u002F Call without signature, should fail\n    }\n}\n```\n\n### Integration Tests (Anchor)\n```typescript\nimport * as anchor from \"@coral-xyz\u002Fanchor\";\n\ndescribe(\"security tests\", () => {\n  it(\"rejects arbitrary CPI\", async () => {\n    const fakeTokenProgram = anchor.web3.Keypair.generate();\n\n    try {\n      await program.methods\n        .withdraw(amount)\n        .accounts({\n          tokenProgram: fakeTokenProgram.publicKey, \u002F\u002F Wrong program\n        })\n        .rpc();\n\n      assert.fail(\"Should have rejected fake program\");\n    } catch (err) {\n      \u002F\u002F Expected to fail\n    }\n  });\n});\n```\n\n### Solana Test Validator\n```bash\n# Run local validator for testing\nsolana-test-validator\n\n# Deploy and test program\nanchor test\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fsolana\u002F`\n- **Trail of Bits Solana Lints**: https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fsolana-lints\n- **Anchor Documentation**: https:\u002F\u002Fwww.anchor-lang.com\u002F\n- **Solana Program Library**: https:\u002F\u002Fgithub.com\u002Fsolana-labs\u002Fsolana-program-library\n- **Solana Cookbook**: https:\u002F\u002Fsolanacookbook.com\u002F\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Solana program audit:\n\n**CPI Security (CRITICAL)**:\n- [ ] ALL CPI calls validate program ID before `invoke()`\n- [ ] Cannot use user-provided program accounts\n- [ ] Anchor: Uses `Program\u003C'info, T>` type\n\n**PDA Security (CRITICAL)**:\n- [ ] PDAs use `find_program_address()` or Anchor `seeds` constraint\n- [ ] Bump seed stored and reused (not user-provided)\n- [ ] PDA accounts validated against canonical address\n\n**Account Validation (HIGH)**:\n- [ ] ALL accounts check owner before deserialization\n- [ ] Native: Validates `account.owner == expected_program_id`\n- [ ] Anchor: Uses `Account\u003C'info, T>` type\n\n**Signer Validation (CRITICAL)**:\n- [ ] ALL authority accounts check `is_signer`\n- [ ] Native: Validates `account.is_signer == true`\n- [ ] Anchor: Uses `Signer\u003C'info>` type\n\n**Sysvar Security (HIGH)**:\n- [ ] Using Solana 1.8.1+\n- [ ] Using checked functions: `load_instruction_at_checked()`\n- [ ] Sysvar addresses validated\n\n**Instruction Introspection (MEDIUM)**:\n- [ ] Using relative indexes for correlation\n- [ ] Proper validation between related instructions\n- [ ] Cannot reuse same instruction across multiple calls\n\n**Testing**:\n- [ ] Unit tests cover all account validation\n- [ ] Integration tests with malicious inputs\n- [ ] Local validator testing completed\n- [ ] Trail of Bits lints enabled and passing\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Ftrailofbits\u002Fskills\u002Fsolana-vulnerability-scanner",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":45,"prompt":55,"zipAvailable":56},[46,49,52],{"tool":47,"command":48},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill solana-vulnerability-scanner",{"tool":50,"command":51},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill solana-vulnerability-scanner",{"tool":53,"command":54},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill solana-vulnerability-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fsolana-vulnerability-scanner\u002FSKILL.md",true,[],[59,69,79,88,94,101],{"skillNo":60,"name":61,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":65,"publishedAt":31},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[64],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[66,67,68],"model","model hierarchy","model hierarchy skill",{"skillNo":70,"name":71,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":75,"publishedAt":31},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[74],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[76,77,78],"MCP","zoom","zoom mcp",{"skillNo":80,"name":81,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":31},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[85,86,87,77],"sdk","zoom apps sdk","apps",{"skillNo":89,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":31},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[90],{"skillNo":95,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":100,"publishedAt":31},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[99],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[96],{"skillNo":102,"name":103,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":31},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[103]]