Field notes from active audits, deep-dives into bug classes we keep finding, and the occasional polemic. New posts roughly every other week.

An unpublished IDL doesn't mean an unrecoverable one. A fallback chain for reconstructing any Solana program's interface, from on-chain metadata and GitHub to IDLGuesser and a fresh-wallet transaction corpus.
Read post →
A malicious IDL can make a trusted Solana program look like it exposes safe instructions while the client signs something else entirely. Here's how the attack works, and why IDLs need to become verifiable build artifacts.

How we managed to make the solana explorer display a program verified badge with our repository for a program we didn't control or have the source code for

Real price ranges, what drives cost, and how to reduce your bill — from a firm that scopes and prices Solana audits daily.

How to dramatically reduce administration risk of your Solana protocols.

How many security checks can you afford in a Solana program when your compute budget is limited? We benchmark common security patterns to give you concrete numbers and optimization strategies.

A deep dive into Compressed NFTs (cNFTs) on Solana, exploring the account-compression and mpl-bubblegum programs. Learn how cNFTs revolutionize NFT scalability by using Merkle trees to store data off-chain, drastically reducing costs and complexity.

100 pieces of Solana tips to improve your Solana dev and auditor skills

We describe how Solana Anchor bundles IDL instructions with your program, and what security implications this has