Skip to main content

Questions tagged [security]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
30 views

Assistance Needed for Updating Locked Metadata Due to Duplicate/Spoof Token Issue

Hello Solana Community, We are facing an issue with our Kenji Meme Token that we just found out after troubleshooting many issues. We found out that shortly after minting, a duplicate/spoof token was ...
Arturo Roman - Kenji Meme's user avatar
0 votes
1 answer
33 views

Can users pass Dummy State Accounts in Solana Program?

I'm working with a Solana program and I have the following code: #[derive(Accounts)] pub struct SomeStruct<'info> { #[account()] pub state: Account<'info, State>, .... } I'm ...
zOthix's user avatar
  • 101
3 votes
2 answers
59 views

Authority in Solana

I'm quite new in Solana, so please confirm or deny: If i make a call to any program having following addresses in the list: my account as signer token address of any status (read/write) my token ...
Белое Безмолвие's user avatar
1 vote
1 answer
36 views

Do we always have to pass the seeds for a PDA in Anchor?

If I want to pass a PDA in anchor I can do it like this: #[derive(Accounts)] #[instruction(my_param: u32)] pub struct MyAccounts<'info> { #[account( seeds = [my_param.to_le_bytes()....
Ahri's user avatar
  • 3,920
0 votes
0 answers
110 views

How to avoid slow rugpulls? (And determine legit transactions)

I guess this is more of a general Solana question than a technical one. I have the basics down like confirming locked liquidity, confirming not mintable, not mutable, distributed wallet supply etc. I ...
Ashraile's user avatar
0 votes
1 answer
123 views

My wallet is making transactions to bubblegum without my permission [closed]

I recently noticed that one of my phantom solana wallets was making daily transactions with Bubblegum. I want to know if this is normal or if I should just delete my wallet. Here is one of the ...
Worried_User's user avatar
2 votes
1 answer
1k views

Is there a risk when I recieve unknown tokens? [closed]

Someone sent to my phantom wallet some AmaraGold Brown tokens a few months ago. I don't know the person nor the tokens. Is there a risk if I have those tokens on my wallet and, if so, what do I need ...
Alix Rey's user avatar
0 votes
2 answers
5k views

How do I lock liquidity for a token on Solana?

When I use Rugcheck.xyz to check my token, it says that I did not lock liquidity and that this is dangerous. Therefore, I want to lock liquidity for my token. How do I do this?
Zq H's user avatar
  • 1
1 vote
1 answer
35 views

Can flood type attacks occur if there isn't a signer for updating data on a PDA?

So this is just something I've been thinking about. Hypothetically, if I had a PDA where anybody can call similar to the basic example below.. #[program] mod hello_anchor { use super::*; pub ...
ZeroNine's user avatar
  • 485
2 votes
1 answer
57 views

Professional way to handle program ownership in production

Is there a preferred format to guarding program upgrade authority keypairs? In anchor, the target folder generates a keypair, which I assume has initial ownership. If I want to switch over the ...
AceGravity's user avatar
1 vote
1 answer
1k views

Public Data API for Token Security

Does there exist a version of an API, like this https://docs.gopluslabs.io/reference/tokensecurityusingget_1 which is not paywalled like birdeye.so API.
data4rtist's user avatar
0 votes
2 answers
82 views

Trying to understand how safe it is to use "processed" , "commited" or "confirmed"

Hey guys anchor noob back at it with another noob question! Alright so I have a program that accepts deposits to a user pda (tx1), based on certain events the user might instantly get a payout from ...
anchor noob's user avatar
1 vote
1 answer
30 views

Creating a single sided vault, using float for calculating ratio

When making a single sided vault, aka deposit X get Y. is it safe to just use a float to get the ratio? right now I just calculate the ratio with like so: (x_underlying_token_account_amount as f64) / (...
anchor noob's user avatar
1 vote
1 answer
173 views

Is it safe to set an account authority to solana system program address

I am letting users create accounts and set a custom authority if they wantfor configuring fields in that account later. If they don't it defaults to the solana program authority "...
anchor noob's user avatar
2 votes
1 answer
80 views

How to secure backend api calls with web3?

In web2 we usualy create a bearer token when authentificating the user, and then use this bearer token in every api call. In web3, since the authentification is made with a wallet (connection), the ...
Effe2's user avatar
  • 1,178
0 votes
1 answer
54 views

How reliable is the accounts: &[AccountInfo] array is?

I am trying to learn solana development[native solana] and when reading some example programs I saw they all use the "accounts: &[AccountInfo]" in order to figure out the accounts ...
Yali Haviv's user avatar
0 votes
0 answers
18 views

What are the ways to protect system files against supply chain attacks (Windows)?

There are a few general ways to fight off supply chain attacks which I'm not gonna go into now. The purpose of this question is to discuss the last line of defense: file protection/encryption in case ...
Josip Volarević's user avatar
3 votes
1 answer
647 views

How insecure are file system wallets

Are they more insecure than myself in my teens? What are the attack vectors? How easily can someone take a sneak peak onto my PC and search for keypair.json? If I'm not mistaken npm packages, VSC ...
Josip Volarević's user avatar
1 vote
1 answer
59 views

Syncing up Web2 games to the blockchain

I was wondering if anyone could provide insight into the following: Let's say I have a Web2 game where a character can run around, fight enemies, and eventually is able to open a chest to receive an ...
LindleyLentati's user avatar
4 votes
2 answers
204 views

How can I tell securely which cluster I am connected to?

I'd like my wallet to be able to tell securely which cluster I am connected to (mainnet-beta, testnet, devnet), from on-chain information. I see a few opportunities with getClusterNodes: From a first ...
Tiago A's user avatar
  • 41
3 votes
1 answer
514 views

Can Solana Accounts be accessed by any Solana Program using its address?

If I have a deployed Solana Program which creates some Solana accounts for storing data in it. Can these Solana accounts be accessed by any other Solana program using the account addresses? I am ...
Rounak Naik's user avatar
0 votes
1 answer
74 views

Learning Programs Security in Solana

I'm looking at learning programs' security in solana. Was wondering if there was something equivalent to Ethernaut or Damn Vulnerable DeFi for Solana programs? Appreciate any help, cheers!
gritty's user avatar
  • 61
0 votes
1 answer
359 views

Does anchor check for program owned account?

For security reasons, I know that we should check for the account owner of certain accounts. Although, if I recall correctly, Anchor already does this by default?
Burger Bob's user avatar
  • 1,456
0 votes
2 answers
269 views

Is it possible make an API POST inside an on-chain program?

Once a transaction has been completed, the application I'm building needs to send a POST to my API.I believe that posting on chain is the most secure approach to go about it (instead of posting from ...
cris.sol's user avatar
  • 272
0 votes
2 answers
84 views

accessing security.txt from python

I am trying to integrate security.txt https://github.com/neodyme-labs/solana-security-txt into a project, and while from the repo it is clear how to access it from rust, I am at a loss as to how to do ...
daoplays's user avatar
  • 587
1 vote
2 answers
707 views

Close PDA account dynamically and conditionally in secure way

I want to close the PDA account only on specif condition. Macro [account(mut, close = <target_account>)] does not work in this case because it will always be triggered after instruction ...
Void's user avatar
  • 396
1 vote
0 answers
43 views

Fixing Replay Attack. Someone added tx to bypass executing by adding an amount not available in the wallet [closed]

So, we had a coinflip sort of logic implemented and sols kept in a pool to be rewarded to someone who wins with a randomizer code in place using blockhash. However, right after we deployed, someone ...
Fahad Bilal's user avatar
1 vote
1 answer
70 views

How should I handle private key when sending transactions?

How can I send a transaction from my backend without leaving the private key in the code? I want only me to be able to do this transaction but if I leave the private key in the code, it is easily ...
george's user avatar
  • 41
2 votes
1 answer
237 views

Seed and Private Key

I use, for example, a Phantom, and I created 10 wallets by seed phase. Then I shared the private key (via export private key) of one of the wallets. Can anyone access the rest of the wallets based on ...
Kanitelk's user avatar
3 votes
1 answer
152 views

What is the real danger of allowing non-canonical bump PDAs?

I was reading this article by the Sec3 folks about how it was dangerous to accept non-canonical bump PDAs in your program since someone can fake one. How exactly would someone create a fake non-...
Richard's user avatar
  • 580
1 vote
2 answers
207 views

React Native integration -- what is the proper way of storing wallet account keypair?

I'm very new to Solana development and want to integrate various web3 elements into my React Native app. Currently, the app generates a keypair for a wallet account using the @solana/web3.js Keypair....
A.J.'s user avatar
  • 11
2 votes
1 answer
35 views

Is the Instruction argument of a CPI enough to protect against undesired behaviour?

Given a cross program invocation, is it safe to assume that constraining the Instruction is enough to prevent any undesired effect? As in validating only program id, accounts and data. So if Vec<...
Arowana's user avatar
  • 2,243
1 vote
1 answer
31 views

Is it possible to extend 'signature' of the PDA?

Let's say, Program A calls Program B via invoke_signed Is it a way for a Program B to reuse these seeds in the second layer CPI? After experimenting a bit, I came to conclusion it cannot be achieved......
Michael's user avatar
  • 308
-3 votes
1 answer
50 views

What was the main cause behind Solana hack in August 2022? [closed]

It was reported in news that nearly 8000 Solana-based wallets were hacked this week which resulted in loss of over $5 million. Has the cause has been identified? Was it some kind of vulnerability ...
kenorb's user avatar
  • 529
1 vote
1 answer
70 views

How to get wallets to recognize instructions (instead of having "unknown instruction") within a transaction?

When sending a transaction, in the wallet confirmation step, in some programs ?the wallet? seems to recognize what the instruction does, whereas in others it just lists the accounts that get written ...
sam's user avatar
  • 13
4 votes
1 answer
76 views

Can you modify a non-PDA account's data when you know its private key [closed]

I am gathering some information about the advantages of PDA accounts over accounts that have private keys. While the obvious one is that there is the potential vulnerability that you can withdraw ...
Sebastian Dine's user avatar
0 votes
3 answers
347 views

How to ensure account passed to anchor is readonly but initialized

So just wanted a confirmation, i know init will check this and if its initialized it will error out, but what is the opposite of init check, i.e check the account passed is initialized ? does anchor ...
Nabeel Naveed's user avatar
5 votes
5 answers
157 views

Is there any issue with vanity addresses from a security p.o.v

this seems like a cool concept : https://solanacookbook.com/references/keypairs-and-wallets.html#how-to-generate-a-vanity-address with this i can generate custom addresses starting with custom words, ...
Nabeel Naveed's user avatar
1 vote
2 answers
80 views

What stops malicious clients from using PDAs in a series of CPIs with anchor?

Let's say we have a series of programs (A -> B -> C) and each one uses PDAs for which the user public keys are used as the seeds. If a normal user calls ProgramA I think this is safe because the ...
kyle's user avatar
  • 261
4 votes
2 answers
81 views

In what ways does Anchor improve security in a solana program?

I had heard that all accounts that are passed into the Accounts struct are enforced to be owned by the program, but that evidently seems to be false
SwayStar123's user avatar
-1 votes
4 answers
115 views

Is there anything that prevents popular programs from being cloned hundreds of times by copycats?

There is a substantial precedent for various marketplaces getting trashed by copycats who reproduce original works hundreds of times in order to capture the lion share of the benefit by diluting out ...
OCDev's user avatar
  • 752
-1 votes
1 answer
52 views

What are ways to protect a novel program solution in order to protect the IP investment of development effort? [closed]

If a team of developers invest a lot of time to build a unique solution to solve a problem, what ways can investors in their efforts protect the effective IP of that work?
OCDev's user avatar
  • 752
0 votes
2 answers
88 views

Are all programs plainly visible within the blockchain? [closed]

Are all programs displayed in plain text? If so, is there a way to obfuscate them so that others are not able to see the contents of the program?
OCDev's user avatar
  • 752
-1 votes
1 answer
77 views

Is there a way to obfuscate programs so that other developers cannot reproduce my business without doing the hard work? [closed]

Are all programs plainly visible within the blockchain? Is there a way to prevent that when writing your program to protect the investment of development effort? If not, what would keep a popular ...
OCDev's user avatar
  • 752
3 votes
1 answer
151 views

How to allow only a specific account to interact with a Solana Program?

use anchor_lang::prelude::*; declare_id!(“example program id); #[program] pub mod example_program { use super::*; pub fn initialize(ctx: Context<Initialize>) -> Result<()> { ...
curiosity's user avatar
  • 499
11 votes
4 answers
355 views

What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?

What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?
Roberto's user avatar
  • 113