Questions tagged [security]
The security tag has no usage guidance.
34
questions
1
vote
1
answer
16
views
Creating a single sided vault, using float for calculating ratio
When making a single sided vault, aka deposit X get Y. is it safe to just use a float to get the ratio?
right now I just calculate the ratio with like so:
(x_underlying_token_account_amount as f64) / (...
- 83
1
vote
1
answer
37
views
Is it safe to set an account authority to solana system program address
I am letting users create accounts and set a custom authority if they wantfor configuring fields in that account later.
If they don't it defaults to the solana program authority "...
- 83
2
votes
1
answer
49
views
How to secure backend api calls with web3?
In web2 we usualy create a bearer token when authentificating the user, and then use this bearer token in every api call.
In web3, since the authentification is made with a wallet (connection), the ...
- 683
0
votes
1
answer
35
views
How reliable is the accounts: &[AccountInfo] array is?
I am trying to learn solana development[native solana] and when reading some example programs I saw they all use the "accounts: &[AccountInfo]" in order to figure out the accounts ...
- 25
0
votes
0
answers
15
views
What are the ways to protect system files against supply chain attacks (Windows)?
There are a few general ways to fight off supply chain attacks which I'm not gonna go into now.
The purpose of this question is to discuss the last line of defense: file protection/encryption in case ...
- 561
3
votes
1
answer
595
views
How insecure are file system wallets
Are they more insecure than myself in my teens?
What are the attack vectors? How easily can someone take a sneak peak onto my PC and search for keypair.json?
If I'm not mistaken npm packages, VSC ...
- 561
1
vote
1
answer
34
views
Syncing up Web2 games to the blockchain
I was wondering if anyone could provide insight into the following:
Let's say I have a Web2 game where a character can run around, fight enemies, and eventually is able to open a chest to receive an ...
4
votes
2
answers
62
views
How can I tell securely which cluster I am connected to?
I'd like my wallet to be able to tell securely which cluster I am connected to (mainnet-beta, testnet, devnet), from on-chain information.
I see a few opportunities with getClusterNodes:
From a first ...
- 41
3
votes
1
answer
215
views
Can Solana Accounts be accessed by any Solana Program using its address?
If I have a deployed Solana Program which creates some Solana accounts for storing data in it. Can these Solana accounts be accessed by any other Solana program using the account addresses? I am ...
- 103
0
votes
1
answer
40
views
Learning Programs Security in Solana
I'm looking at learning programs' security in solana. Was wondering if there was something equivalent to Ethernaut or Damn Vulnerable DeFi for Solana programs?
Appreciate any help, cheers!
- 61
0
votes
1
answer
111
views
Does anchor check for program owned account?
For security reasons, I know that we should check for the account owner of certain accounts. Although, if I recall correctly, Anchor already does this by default?
- 1,124
0
votes
2
answers
104
views
Is it possible make an API POST inside an on-chain program?
Once a transaction has been completed, the application I'm building needs to send a POST to my API.I believe that posting on chain is the most secure approach to go about it (instead of posting from ...
- 272
0
votes
2
answers
51
views
accessing security.txt from python
I am trying to integrate security.txt https://github.com/neodyme-labs/solana-security-txt into a project, and while from the repo it is clear how to access it from rust, I am at a loss as to how to do ...
- 487
1
vote
2
answers
477
views
Close PDA account dynamically and conditionally in secure way
I want to close the PDA account only on specif condition. Macro [account(mut, close = <target_account>)] does not work in this case because it will always be triggered after instruction ...
- 386
1
vote
0
answers
22
views
Fixing Replay Attack. Someone added tx to bypass executing by adding an amount not available in the wallet [closed]
So, we had a coinflip sort of logic implemented and sols kept in a pool to be rewarded to someone who wins with a randomizer code in place using blockhash. However, right after we deployed, someone ...
- 21
0
votes
0
answers
26
views
Send transactions to the smart contract
How can I send a transaction from my backend without leaving the private key in the code?
I want only me to be able to do this transaction but if I leave the private key in the code, it is easily ...
- 31
2
votes
1
answer
91
views
Seed and Private Key
I use, for example, a Phantom, and I created 10 wallets by seed phase.
Then I shared the private key (via export private key) of one of the wallets.
Can anyone access the rest of the wallets based on ...
- 83
2
votes
0
answers
96
views
What is the real danger of allowing non-canonical bump PDAs?
I was reading this article by the Sec3 folks about how it was dangerous to accept non-canonical bump PDAs in your program since someone can fake one.
How exactly would someone create a fake non-...
- 430
1
vote
2
answers
125
views
React Native integration -- what is the proper way of storing wallet account keypair?
I'm very new to Solana development and want to integrate various web3 elements into my React Native app.
Currently, the app generates a keypair for a wallet account using the @solana/web3.js Keypair....
- 11
2
votes
1
answer
30
views
Is the Instruction argument of a CPI enough to protect against undesired behaviour?
Given a cross program invocation, is it safe to assume that constraining the Instruction is enough to prevent any undesired effect?
As in validating only program id, accounts and data.
So if Vec<...
- 2,133
1
vote
1
answer
28
views
Is it possible to extend 'signature' of the PDA?
Let's say, Program A calls Program B via invoke_signed
Is it a way for a Program B to reuse these seeds in the second layer CPI?
After experimenting a bit, I came to conclusion it cannot be achieved......
- 188
-3
votes
1
answer
41
views
What was the main cause behind Solana hack in August 2022? [closed]
It was reported in news that nearly 8000 Solana-based wallets were hacked this week which resulted in loss of over $5 million.
Has the cause has been identified? Was it some kind of vulnerability ...
- 499
1
vote
1
answer
36
views
How to get wallets to recognize instructions (instead of having "unknown instruction") within a transaction?
When sending a transaction, in the wallet confirmation step, in some programs ?the wallet? seems to recognize what the instruction does, whereas in others it just lists the accounts that get written ...
- 13
4
votes
1
answer
56
views
Can you modify a non-PDA account's data when you know its private key [closed]
I am gathering some information about the advantages of PDA accounts over accounts that have private keys. While the obvious one is that there is the potential vulnerability that you can withdraw ...
- 330
0
votes
3
answers
119
views
How to ensure account passed to anchor is readonly but initialized
So just wanted a confirmation, i know init will check this and if its initialized it will error out, but what is the opposite of init check, i.e check the account passed is initialized ?
does anchor ...
- 685
5
votes
5
answers
75
views
Is there any issue with vanity addresses from a security p.o.v
this seems like a cool concept : https://solanacookbook.com/references/keypairs-and-wallets.html#how-to-generate-a-vanity-address
with this i can generate custom addresses starting with custom words, ...
- 685
1
vote
2
answers
71
views
What stops malicious clients from using PDAs in a series of CPIs with anchor?
Let's say we have a series of programs (A -> B -> C) and each one uses PDAs for which the user public keys are used as the seeds.
If a normal user calls ProgramA I think this is safe because the ...
4
votes
2
answers
65
views
In what ways does Anchor improve security in a solana program?
I had heard that all accounts that are passed into the Accounts struct are enforced to be owned by the program, but that evidently seems to be false
- 142
-1
votes
4
answers
96
views
Is there anything that prevents popular programs from being cloned hundreds of times by copycats?
There is a substantial precedent for various marketplaces getting trashed by copycats who reproduce original works hundreds of times in order to capture the lion share of the benefit by diluting out ...
- 682
-1
votes
1
answer
49
views
What are ways to protect a novel program solution in order to protect the IP investment of development effort? [closed]
If a team of developers invest a lot of time to build a unique solution to solve a problem, what ways can investors in their efforts protect the effective IP of that work?
- 682
0
votes
2
answers
63
views
Are all programs plainly visible within the blockchain? [closed]
Are all programs displayed in plain text?
If so, is there a way to obfuscate them so that others are not able to see the contents of the program?
- 682
-1
votes
1
answer
62
views
Is there a way to obfuscate programs so that other developers cannot reproduce my business without doing the hard work? [closed]
Are all programs plainly visible within the blockchain? Is there a way to prevent that when writing your program to protect the investment of development effort? If not, what would keep a popular ...
- 682
3
votes
1
answer
101
views
How to allow only a specific account to interact with a Solana Program?
use anchor_lang::prelude::*;
declare_id!(“example program id);
#[program]
pub mod example_program {
use super::*;
pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
...
- 479
9
votes
4
answers
216
views
What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?
What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?
- 93