{"id":83867,"url":"https://github.com/0xMacro/awesome-solana-security","name":"awesome-solana-security","description":"A collection of resources to help you build better and more secure Solana programs. Kept up to date.","projects_count":82,"last_synced_at":"2026-09-03T18:00:45.443Z","repository":{"id":265032810,"uuid":"894911766","full_name":"0xMacro/awesome-solana-security","owner":"0xMacro","description":"A collection of resources to help you build better and more secure Solana programs. Kept up to date.","archived":false,"fork":false,"pushed_at":"2025-12-06T12:33:39.000Z","size":706,"stargazers_count":600,"open_issues_count":12,"forks_count":72,"subscribers_count":6,"default_branch":"master","last_synced_at":"2026-08-30T19:24:02.192Z","etag":null,"topics":["anchor","audit","resources","rust","security","security-audit","solana","solana-program","solana-security"],"latest_commit_sha":null,"homepage":"https://0xmacro.com/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xMacro.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-11-27T08:19:59.000Z","updated_at":"2026-08-28T04:48:19.000Z","dependencies_parsed_at":"2026-01-01T04:07:26.545Z","dependency_job_id":null,"html_url":"https://github.com/0xMacro/awesome-solana-security","commit_stats":null,"previous_names":["0xmacro/solana-security-note","0xmacro/awesome-solana-security"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/0xMacro/awesome-solana-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xMacro%2Fawesome-solana-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xMacro%2Fawesome-solana-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xMacro%2Fawesome-solana-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xMacro%2Fawesome-solana-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xMacro","download_url":"https://codeload.github.com/0xMacro/awesome-solana-security/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xMacro%2Fawesome-solana-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":37019614,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-03T02:00:05.968Z","response_time":58,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"created_at":"2025-01-28T14:01:46.689Z","updated_at":"2026-09-03T18:00:45.443Z","primary_language":null,"list_of_lists":false,"displayable":true,"categories":["Uncategorized","Audit Contests","Development Resources","Security Resources"],"sub_categories":["Uncategorized","Rust","Solana using Anchor Framework","Solana Program Library (SPL)"],"readme":"# Awesome Solana Security\n\nResources to help you build better and more secure Solana programs. Kept up to date.\n\n### Official Resources\n\n- [Solana docs](https://solana.com/docs/) \n- [Solana courses](https://solana.com/developers/courses/)\n- [Solana cookbook](https://solana.com/developers/cookbook) \n- [Solana examples supporting multiple frameworks](https://github.com/solana-developers/program-examples)\n- [Solana bootcamp 2024](https://github.com/solana-developers/developer-bootcamp-2024)\n- [SPL (Solana Program Library) docs](https://spl.solana.com/): SPL is an official collection of programs to help you build your own Solana program.\n\n### Rust\nIf you need a primer on Rust, these resources are for you:\n\n- [Rust book](https://doc.rust-lang.org/book/)\n- [Rust by example](https://doc.rust-lang.org/rust-by-example/index.html)\n- [Rust cheatsheet](https://cheats.rs/)\n### Solana Resources Using Native Rust\n- [Solana's native Rust docs](https://solana.com/docs/programs/rust)\n- [Solana's native Rust course](https://solana.com/developers/courses/native-onchain-development)\n\n### Solana Resources Using Anchor Framework\nWe highly recommend using [Anchor](https://www.anchor-lang.com), a framework for building secure Solana programs.\n\n- [Anchor docs](https://www.anchor-lang.com/docs)\n- [Anchor book](https://book.anchor-lang.com/) \n- [Anchor by example](https://examples.anchor-lang.com/)\n- [Anchor wiki](https://docs.rs/anchor-lang)\n- [Anchor SPL wiki](https://docs.rs/anchor-spl)\n\n### Solana Resources for EVM transitioners\n- [RareSkills' Solana course for Ethereum developers](https://www.rareskills.io/solana-tutorial)\n- [0xkowloon's Anchor for EVM developers](https://0xkowloon.gitbook.io/anchor-for-evm-developers)\n- [S3v3ru5's Solana Beginner Notes](https://s3v3ru5.github.io/posts/solana-beginner-notes/)\n\n\n### General Resources\n- [Ackee's Solana handbook](https://ackee.xyz/solana/book/latest/)\n- [Blueshift's Anchor and Pinocchio courses and challenges](https://learn.blueshift.gg/)\n- [Rektoff's Security roadmap](https://github.com/Rektoff/Security-Roadmap-for-Solana-applications)\n- [Helius's blog](https://www.helius.dev/blog): Frequently publishes Solana-related content\n- [Pine Analytics's Substack](https://substack.com/@pineanalytics1): Focuses on deep diving into features of Solana protocols\n\n- [Infect3d's Essentials for Starting Solana Auditing](https://www.infect3d.xyz/blog/solana-quick-start)\n- [Lucrative_Panda's highly detailed research article that covers all of Solana's security incidents](https://medium.com/@lucrativepanda/a-comprehensive-analysis-of-solanas-security-history-all-incidents-impacts-and-evolution-up-to-1b1564c7ddfe)\n- [r0bre's 100 Daily Solana Tips](https://accretionxyz.substack.com/p/r0bres-100-daily-solana-tips)\n- [Accretion's Hidden IDL Instructions and How to Abuse Them](https://accretionxyz.substack.com/p/hidden-idl-instructions-and-how-to)\n- [Farouk ELALEM's explanation of how Solana programs work under the hood](https://ubermensch.blog/under-the-hood-of-solana-program-execution-from-rust-code-to-sbf-bytecode)\n- [Ottersec's lamport transfers vulnerabilities](https://osec.io/blog/2025-05-14-king-of-the-sol)\n- [Asymmetric Research's analysis of CPI vulnerabilities](https://blog.asymmetric.re/invocation-security-navigating-vulnerabilities-in-solana-cpis/)\n- [Alex Lazar's analysis of CPI vulnerabilities](https://newsletter.alexlazar.dev/p/external-calls-are-dangerous)\n- [AlexAlekhinEth's high-level explanation of Solana network architecture](https://medium.com/@AlexAlekhinEth/solana-how-it-works-a-technical-deep-dive-b180468abc3d)\n- [Helius's complete history of Solana outages](https://www.helius.dev/blog/solana-outages-complete-history)\n- [Exo Tech's guide for developers on creating auditor-friendly architecture documentation](https://exotechnologies.xyz/p/a-developer-s-guide-to-audit-readiness)\n\n\n- Solana's general common vulnerabilities:\n  - [Solana security course](https://solana.com/developers/courses/program-security)\n  - [Urataps's program examples with vulnerabilities](https://github.com/urataps/solana-audit-examples)\n  - [Helius's common vulnerabilities](https://www.helius.dev/blog/a-hitchhikers-guide-to-solana-program-security) \n  - [ImmuneBytes's common Solana attack vectors](https://github.com/ImmuneBytes-Security-Audit/Blockchain-Attack-Vectors/tree/main/Solana%20Attack%20Vectors)\n  - [Slowmist's Solana best practices](https://github.com/slowmist/solana-smart-contract-security-best-practices)\n  - [Exvul's Solana security guide](https://exvul.com/rust-smart-contract-security-guide-in-solana/)\n  - [Zigtur's Solana security walkthrough](https://www.youtube.com/watch?v=xd6qfY-GDYY)\n  - [M4rio's Solana security walkthrough](https://www.youtube.com/watch?v=q4z8tIi43lg)\n  - [Nirlin's advanced Solana vulnerabilities](https://substack.com/inbox/post/164534668)\n\n\n- Token-2022 Security resources:\n  - Offside's Token-2022 best practices [Part 1](https://blog.offside.io/p/token-2022-security-best-practices-part-1) and [Part 2](https://blog.offside.io/p/token-2022-security-best-practices-part-2)\n  - [Neodyme's Token-2022 security](https://neodyme.io/en/blog/token-2022)\n\n\n### Codebases to Study\n**Essential:**\n- [Anchor framework](https://github.com/solana-foundation/anchor)\n- [Solana system program](https://github.com/solana-program/system)\n- [Solana token program](https://github.com/solana-program/token)\n- [Solana token-2022 program](https://github.com/solana-program/token-2022)\n- [Solana ATA (Associated Token Account) program](https://github.com/solana-program/associated-token-account)\n- [Solana token metadata program](https://github.com/solana-program/token-metadata)\n- [Metaplex's token metadata program](https://github.com/metaplex-foundation/mpl-token-metadata)\n\n**Optional:**\n- [Raydium program](https://github.com/raydium-io/raydium-cp-swap): AMM protocol\n- [Kamino program](https://github.com/Kamino-Finance/klend): Lending protocol\n- [Squads program](https://github.com/Squads-Protocol/v4): Multisig protocol\n- [Solana Upgradeable BPF Loader program](https://github.com/solana-program/loader-v3)\n- [Solana Address Lookup Table program](https://github.com/solana-program/address-lookup-table)\n\n### Places to Ask Questions\n- [Solana Stack Exchange](https://solana.stackexchange.com/) \n\n### Tools\n- [Solana playground](https://beta.solpg.io/) \n- [Rust playground](https://play.rust-lang.org/)\n- [Sec3's IDL Guesser](https://github.com/sec3-service/IDLGuesser): Reverse engineers IDL from onchain programs for easier integration\n- [Trail of Bits's Anchor X-ray](https://github.com/crytic/anchorx-ray): Visualizes accounts in Anchor programs\n- [John Saigle's Anchor version detector](https://github.com/johnsaigle/anchor-version-detector): Helps figure out which versions of Rust, Solana, and Anchor are compatible with a given Anchor project.\n- [Ackee's Trident](https://ackee.xyz/trident/docs/latest/): Fuzzing framework for Solana\n- [Ackee's Solana IDE extension](https://marketplace.visualstudio.com/items?itemName=AckeeBlockchain.solana): Automatically detects common security issues in Solana programs and visualizes Trident fuzzing coverage\n\n### CTFs\n- [Ackee Solana CTF](https://github.com/Ackee-Blockchain/Solana-Auditors-Bootcamp/tree/master/Capture-the-Flag)\n\n### Audit Contests\nSolana security audits that are publicly available:\n\n- [Orderly on Sherlock](https://audits.sherlock.xyz/contests/524/report): 2 High and 1 Medium \n- [WOOFi on Sherlock](https://audits.sherlock.xyz/contests/535/report): 2 High and 3 Medium \n- [Pump Science on Code4rena](https://code4rena.com/reports/2025-01-pump-science): 2 High and 3 Medium\n- [Token22 Confidential Transfer on Code4rena](https://code4rena.com/reports/2025-08-solana-foundation): 7 Low\n- [Meteora on Code4rena](https://code4rena.com/reports/2025-08-meteora-dynamic-bonding-curve): 2 Medium\n\n**NOTE: Contact `0xmorph` in the Cantina Discord server to gain read access if you don't have it.**\n- [Grass on Cantina](https://cantina.xyz/competitions/3211ee0d-133f-43a0-837e-8dc1ecfaa424): 13 High and 6 Medium\n- [Olas on Cantina](https://cantina.xyz/competitions/829164bf-7fba-4b84-a6b8-76652205bd97): 2 High and 3 Medium\n- [Tensor on Cantina](https://cantina.xyz/competitions/21787352-de2c-4a77-af09-cc0a250d1f04): 5 High and 10 Medium\n- [ZetaChain on Cantina](https://cantina.xyz/competitions/80a33cf0-ad69-4163-a269-d27756aacb5e): 6 High and 27 Medium (partial Solana scope)\n- [Inclusive Finance on Cantina](https://cantina.xyz/competitions/3eff5a8f-b73a-4cfe-8c54-546b475548f0): 45 High and 25 Medium (partial Solana scope)\n- [Reserve Index on Cantina](https://cantina.xyz/code/8b94becd-54e7-41cd-88e6-caae7becc76a): 10 High and 11 Medium\n- [Solayer on Cantina](https://cantina.xyz/code/0f543452-2076-438f-86ae-bbd6b065fffb): 3 High and 6 Medium\n- [Genius on Cantina](https://cantina.xyz/code/12acc80c-4e4c-4081-a0a3-faa92150651a): 6 High and 4 Medium (partial Solana scope)\n\n**NOTE: First Flights are introductory audit challenges with smaller codebases, designed for beginners to practice finding vulnerabilities.**\n- [RustFund first flight](https://codehawks.cyfrin.io/c/2025-03-rustfund/results?t=report): 4 High and 3 Medium\n- [SSSwap first flight](https://codehawks.cyfrin.io/c/2025-05-ssswap/results?t=report): 5 High and 4 Medium\n\n","projects_url":"https://awesome.ecosyste.ms/api/v1/lists/0xmacro%2Fawesome-solana-security/projects"}