13
votes
Accepted
What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?
You can check out this github repo where some possible exploits and their recommended safety checks are given.
To list some important ones:
Try to avoid AccountInfo account type wherever possible. ...
- 1,364
7
votes
How can I tell securely which cluster I am connected to?
You can request the genesis hash with getGenesisHash method from the rpc endpoint and compare it to the ones below to get the cluster.
Devnet: EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG
Testnet: ...
- 2,909
7
votes
Accepted
How insecure are file system wallets
They are as secure as your personal compute habits, which for most people are not great. The reason they are considered to be relatively "insecure" is that they are effectively a plain text ...
- 1,199
6
votes
Accepted
Can you modify a non-PDA account's data when you know its private key
I wonder if there is a way to modify the account's data without the program if you know its private key?
No. There are two concepts that are at play. Ownership and signing authority.
Only the owner ...
- 2,907
6
votes
In what ways does Anchor improve security in a solana program?
Answering the question posed in the body of the text, more so than the title of the post.
Any account in the account struct that uses the syntax this_account: Account<'info, ThisAccount> will ...
- 2,949
5
votes
What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?
The creator of the Anchor framework, Armani, has put up a repo which contains some of the common exploits and how you can prevent those through best practices. I would also highly suggest going ...
- 1,682
5
votes
Accepted
How to allow only a specific account to interact with a Solana Program?
Something like this should work
use anchor_lang::prelude::*;
use std::str::FromStr;
declare_id!("example program id");
const ALLOWED_PUBKEY: &str = "particular pubkey";
#[...
- 1,364
5
votes
Accepted
Can Solana Accounts be accessed by any Solana Program using its address?
Reading
Any program can read data from and credit SOL to any Solana account.
Writing
Where permission to write to an account is concerned, there are restrictions. All Solana accounts have a field of ...
- 3,153
5
votes
Authority in Solana
Yes, but key thing here is that you must sign the transaction. Your digital signature is the most important thing here, and if a transaction is signed by you, then anything can be done in that ...
- 1,121
4
votes
Accepted
Is there a way to obfuscate programs so that other developers cannot reproduce my business without doing the hard work?
Are all programs plainly visible within the blockchain?
Yes. If a program is deployed, it is visible (e.g. on an explorer) and can be downloaded by anyone, and then re-deployed. For instance, solana -...
- 710
4
votes
Is there any issue with vanity addresses from a security p.o.v
No, It's the same as any randomly generated Keypairs.
Some security precautions you should follow very very carefully like:
Keeping the corresponding secret key in a very very secure cage.
Use a ...
- 171
4
votes
Accepted
Are all programs plainly visible within the blockchain?
Programs are stored by default as BPF bytecode on-chain. This in itself is not entirely readable. You can get these program's bytecode with:
Solana program dump -um <program_address> program.so
...
- 4,019
4
votes
Accepted
What stops malicious clients from using PDAs in a series of CPIs with anchor?
Every PDA is derived from one Program, whose programID is part of the seed.
So let's say PDAaUW is derived from ProgramA and a user wallet's public key. Then ONLY ProgramA has write access to the PDA. ...
- 2,309
4
votes
Accepted
Professional way to handle program ownership in production
Generally there's two ways this is handled:
Upgrade authority is owned by a Multisig, meaning if you want to upgrade, the threshold specified in your multisig must be reached. The most popular ...
- 5,384
3
votes
In what ways does Anchor improve security in a solana program?
https://github.com/coral-xyz/sealevel-attacks
There's a pretty comprehensive list of how Anchor makes Solana programs safer by doing a lot of checks for you.
As to the other question, not all accounts ...
- 3,944
3
votes
What are the best practices I can do to secure my Solana smart contracts if I can't afford an audit?
While these won't comprehensively secure your program, there are a few security checks you can keep in mind;
Ownership checks:
An ownership check verifies that an account is owned by the expected ...
- 2,907
3
votes
Accepted
Is there anything that prevents popular programs from being cloned hundreds of times by copycats?
While the binary code itself can easily be copied, I would say most real-world programs that solve any non-trivial problems will have sort of feautures built-in that gives the creators some form of ...
- 2,309
3
votes
How can I tell securely which cluster I am connected to?
In general, I'd agree with the other poster that getGenesisHash is the way to go as those hashes do not / will not change for each cluster.
From a first sight, shredVersion seems to provide unique ...
- 586
3
votes
Accepted
How reliable is the accounts: &[AccountInfo] array is?
Accounts array is as reliable as you make it!
Note: Even though the user sends the accounts array, it is the program which decides the sequence of the accounts and communicates that to the user. The ...
- 1,991
3
votes
Accepted
How to secure backend api calls with web3?
You can still use a bearer token, your wallet sign-in just replaces the username/password login in your flow. Once the user authenticates their credentials you can issue them a token as you would when ...
- 3,607
3
votes
Accepted
Can flood type attacks occur if there isn't a signer for updating data on a PDA?
It would work just like any other transaction. If there's a write lock on the account, the transaction scheduler needs to execute all transactions referencing the account serially, and that account ...
- 19.6k
2
votes
Is there anything that prevents popular programs from being cloned hundreds of times by copycats?
Not sure I see a great difference with the original question, in light of the answer I gave there. Solana is a public blockchain => your binaries can be copied.
Whether or not your whole product ...
- 710
2
votes
Is there anything that prevents popular programs from being cloned hundreds of times by copycats?
Programs can be "forked" and redeployed just fine. Ultimately the program that beats others is the one with the best features, UX, and speed to shipping.
You can dump a program and redeploy:
...
- 4,019
2
votes
Is there anything that prevents popular programs from being cloned hundreds of times by copycats?
When you deploy a solana program only the programs' bytecode is uploaded to the network. That itself can be rather obscure and difficult to make sense of.
I haven't heard of any solution to prevent ...
- 343
2
votes
Are all programs plainly visible within the blockchain?
You can always obfuscate your code but that will increase the cost of executing your programs' instructions. Your program is stored as bytecode on the solana blockchain that itself can be quite ...
- 343
2
votes
How to ensure account passed to anchor is readonly but initialized
There's no explicit check needed here. As long as there's no init, zero or zero_copy attribute for the account, the validator expects it to have been created. The answer to your question is yes, the ...
- 3,944
2
votes
What was the main cause behind Solana hack in August 2022?
At the time of writing a full detailed post mortem has not been released. Slope wallet has admitted some fault in the leaking of seed phrases.
As far as we know currently, the Solana blockchain itself ...
- 170
2
votes
React Native integration -- what is the proper way of storing wallet account keypair?
Most applications will leave the key management aspect to a third-party wallet, which handles the storage of the private key, uses it to sign transactions, and offers various utility operations like ...
- 3,607
2
votes
Close PDA account dynamically and conditionally in secure way
I found the source code for close macro (docs) which has a lot of similarities with my code:
use crate::bpf_writer::BpfWriter;
use crate::error::ErrorCode;
use crate::prelude::error;
use crate::Result;...
- 416
2
votes
Accepted
Is it possible make an API POST inside an on-chain program?
Short answer is no, you can't make any external connections from an on-chain application.
Long answer, you can emit an event on-chain, and you can have an external application listen for on-chain ...
- 3,607
Only top scored, non community-wiki answers of a minimum length are eligible