Solana security, written by the researchers doing the work.
Field notes from active audits, deep-dives into bug classes we keep finding, and the occasional polemic. New posts roughly every other week.
Move your Solana program to sBPF v3 while you have time
Solana is preparing to stop accepting deployments of older sBPF programs. v3 is live now and the restriction is expected around November 2026. Rebuild, test, and redeploy as sBPF v3 while you have time, so you are not discovering a broken toolchain in the middle of an incident.
Read post →
How to build a Solana program test suite that catches real bugs
A test that prints "success" proves almost nothing. Build the suite around instruction and lifecycle tests that verify state, precise failure assertions, boundary cases, regressions, and a real integration layer. That is the coverage that actually catches bugs.
The First Thing I Look at in Every Solana Program Audit
After 100+ Solana program audits, my first pass always starts in the same four places: CPIs, account lifecycle, remaining_accounts, and signature verification. That's where the obvious criticals hide.
How to Get Any Solana Program's IDL
An unpublished IDL doesn't mean an unrecoverable one. A fallback chain for reconstructing any Solana program's interface, from on-chain metadata and GitHub to IDLGuesser and a fresh-wallet transaction corpus.
Malicious Solana IDLs: When depositFunds Calls withdrawFunds
A malicious IDL can make a trusted Solana program look like it exposes safe instructions while the client signs something else entirely. Here's how the attack works, and why IDLs need to become verifiable build artifacts.
How We Hacked Solana Verified Builds
How we managed to make the solana explorer display a program verified badge with our repository for a program we didn't control or have the source code for
How Much Does a Solana Audit Cost in 2026? (From an Actual Solana Audit Firm)
Real price ranges, what drives cost, and how to reduce your bill — from a firm that scopes and prices Solana audits daily.
Designing Better In-Protocol Authority Structures
How to dramatically reduce administration risk of your Solana protocols.
The Cost of Security in Solana Programs
How many security checks can you afford in a Solana program when your compute budget is limited? We benchmark common security patterns to give you concrete numbers and optimization strategies.
Compressed NFTs on Solana
A deep dive into Compressed NFTs (cNFTs) on Solana, exploring the account-compression and mpl-bubblegum programs. Learn how cNFTs revolutionize NFT scalability by using Merkle trees to store data off-chain, drastically reducing costs and complexity.
r0bre's 100 daily Solana tips
100 pieces of Solana tips to improve your Solana dev and auditor skills
Hidden IDL Instructions and How To Abuse Them
We describe how Solana Anchor bundles IDL instructions with your program, and what security implications this has
Accretion Labs Pte. Ltd.
65 Chulia Street, #46-00 OCBC Centre
Singapore 049513
Singapore
UEN 202502288W