Solana Audits

Solana programs share almost nothing with the Ethereum mental model. There is no implicit msg.sender, no automatic storage, no per-contract state. Every account is just bytes; every check is one your program has to make explicitly. An audit that’s correct on Ethereum can be silently wrong on Solana.

We treat the runtime as part of the threat model. Compute-unit exhaustion, log truncation, instruction reordering, CPI privilege carry-over, account type confusion, these aren’t edge cases on Solana, they’re the substrate every program runs on. We catalogue them by program type and walk through each one explicitly on every engagement.

Our researchers work in parallel, not sharing notes, each one reporting findings as they go. The point is divergence: everyone uses their own approach and follows their own instincts rather than converging on a single reading. There is no reconciliation step, we report issues as we find them.

The engagement runs as a living GitHub repository. We file issues as we find them, with fix tracking and discussion threads, so you can start remediating before the audit is even over. The final deliverable is a PDF report with severity ratings, bug summaries, and remediation guidance. Fix verification is included with unlimited rounds within reasonable time bounds, no surprise per-review costs the way other firms charge. Reports are only made public if you publish them or give us permission to.