Pinocchio Audits

Pinocchio programs are lean. They strip away the macros and abstractions of a framework like Anchor to get tighter compute and smaller binaries, and the best-built ones are genuinely efficient. The trade-off is that every check the framework would have written for you is now yours to write by hand, which is also why we tend to find more bugs in Pinocchio programs than in equivalent Anchor ones.

There is no single “Pinocchio way” to validate an account or lay out state, so we adapt to however you built it. The serialization you chose, the account-validation approach you settled on, the dispatch style you prefer, we read the program on its own terms rather than against a template. We are as flexible as the framework is.

In practice that means reading every instruction handler closely, because the bugs usually come from a check that is present in one handler but quietly missing in a near-identical one. Custom serialization gets the same attention: Borsh layouts, bytemuck casts, length-prefixed buffers, raw slice indexing, anywhere attacker-controlled length or content could cause a panic, a slice over-read, or a wrong-account read.

We have audited multiple Pinocchio programs in production, and we have reported bugs in Pinocchio itself, so we arrive knowing both how these programs tend to be written and where the framework’s own sharp edges are.