Solana DeFi Audits

Most exploits we’ve seen on Solana DeFi protocols didn’t need a memory-safety bug or a missing signer check. They needed someone who understood the protocol’s economics, and the incentives of everyone touching it, from a different angle than the team did. A rounding decision that looks correct in one path leaks value when it’s called in another order; a fee tier interacts with a liquidation incentive to hand an attacker a strictly-better strategy.

So a DeFi audit, for us, is mostly about understanding. How the protocol actually works, what each participant is incentivised to do, how it fits into the rest of the ecosystem, and what happens to it under market conditions the team didn’t plan for. The bugs that matter usually live in the gap between how a protocol is supposed to behave and how the market will actually push it.

We pay particular attention to the seams. Oracle integrations and their staleness and manipulation profiles, liquidation and funding logic under partial fills and price gaps, and the external protocols yours composes with. A dependency that’s perfectly safe on its own can become a lever the moment the market moves against it.

Combine that economic reading with the deep knowledge of the Solana runtime we bring to every engagement, and the findings that come out are often the ones nobody else would catch: bugs that only surface when an economic edge case meets a runtime quirk. Under the hood this is the same audit as the rest of our Solana work, just with the extra focus that DeFi demands.