Anchor Audits
Framework-aware audits from researchers who know Anchor inside out, across every version.
Fundamentally the same deep review as our standard Solana audit, run by people who know Anchor inside out. We've worked across every Anchor version and know exactly what the framework checks for you, what it quietly leaves to you, and the mistakes developers make most often when writing Anchor programs.
We know what Anchor checks for you, and what it quietly doesn't.
Anchor does a lot of work behind its macros, which is exactly why it’s easy to misplace trust in it. A constraint that looks like it’s enforcing something might not be; an account that looks validated might only be half-checked. Most of the Anchor bugs we find live in the gap between what a developer assumes the framework guarantees and what it actually does.
We’ve worked across every Anchor version, and the footguns shift between them. A pattern that’s safe in one release behaves differently in another, and the version a program ends up compiling against isn’t always the one the team thinks they pinned. We read your program against the framework it actually builds with, not against “Anchor in general.”
Beyond the framework’s own behaviour, we know the mistakes developers make in Anchor: constraint combinations that look complete but aren’t, init-if-needed paths that re-initialize state in production, account structs missing a check everyone assumed was implicit. We’ve seen them enough times to know where to look first.
We also know what good Anchor looks like, and we help define it. Remediation comes back in idiomatic Anchor, working with the macros rather than around them, alongside the best-practice patterns and optimizations that make the program easier to keep correct as it grows.
What we cover
The surface area of a typical engagement.Account constraints
Completeness of #[account(...)] constraints; missing has_one, mut, signer, init_if_needed.
Typical Anchor mistakes
The errors we see most often in Anchor programs, from misplaced trust in constraints to state that can be silently re-initialized.
Best practices
Whether the program follows the patterns that keep Anchor code correct as it grows, and where it drifts from them.
Optimizations
Account and constraint patterns that cut compute and rent without giving up safety.
How we work
Scoping & threat model
We map trust boundaries, identify privileged paths, and agree on what's in-scope before kickoff.
Deep manual review
Two researchers read every instruction, account struct, and constraint, with Anchor’s actual behaviour in mind.
Hunt the Anchor quirks
We check what the framework is and isn’t enforcing for you, plus the version-specific footguns that bite real programs.
Report & fix verification
A PDF report with severity ratings, summaries, and remediation guidance, plus fix verification with unlimited rounds within reasonable time bounds.
Selected engagements
Anchor programs we’ve read line-by-line, across many framework versions.
Ready to audit your protocol?
Submit your protocol for review and we'll respond within 24 hours. Our researchers have prevented 50+ critical exploits across the Solana ecosystem.
Accretion Labs Pte. Ltd.
65 Chulia Street, #46-00 OCBC Centre
Singapore 049513
Singapore
UEN 202502288W