Advancing Blockchain Security
Our team actively contributes to the security of the Solana ecosystem through responsible disclosure, open-source tools, and published research.
CVE Disclosures
Vulnerabilities we've responsibly disclosed to improve ecosystem security
CVE-2024-38291CriticalFixedReentrancy Vulnerability in SolSwap Protocol
Discovered a critical reentrancy vulnerability in the swap function that could allow attackers to drain liquidity pools.
CVE-2024-35102HighFixedInteger Overflow in Token Staking Contract
Integer overflow in reward calculation could result in incorrect reward distribution and potential fund loss.
CVE-2024-31847HighFixedAccess Control Bypass in NFT Marketplace
Missing validation in listing function allowed unauthorized users to modify listing parameters.
CVE-2024-28556CriticalFixedOracle Manipulation in Lending Protocol
Price oracle could be manipulated through flash loans, enabling under-collateralized borrowing.
CVE-2024-22134CriticalFixedSignature Validation Flaw in Bridge Contract
Improper signature verification allowed forged cross-chain messages to be processed.
Published Research
Peer-reviewed papers and technical reports advancing blockchain security knowledge
Comprehensive Analysis of Solana Smart Contract Vulnerabilities
Chen, M., Mitchell, S., Rodriguez, J.
A systematic study of 500+ Solana programs identifying common vulnerability patterns and proposing automated detection methods.
Flash Loan Attack Vectors in DeFi Protocols
Rodriguez, J., Chen, M.
Detailed analysis of flash loan attacks on Solana DeFi protocols with mitigation strategies and best practices.
Anchor Framework Security: Common Pitfalls and Solutions
Mitchell, S., Rodriguez, J.
Security considerations when building with Anchor, including account validation, PDA security, and CPI guards.
Cross-Program Invocation Security Analysis
Chen, M., Mitchell, S.
Examination of CPI-related vulnerabilities and secure patterns for inter-program communication on Solana.
Open Source Tools
Free security tools we maintain for the community
solcertup-scanner
Automated vulnerability scanner for Solana smart contracts. Detects 50+ vulnerability patterns.
anchor-security-checks
Security linting rules for Anchor framework programs. Integrates with CI/CD pipelines.
solana-fuzz
Fuzzing framework for Solana programs. Find edge cases and unexpected behaviors.
defi-attack-vectors
Educational repository documenting DeFi attack vectors with PoC implementations.
Responsible Disclosure Policy
We believe in responsible disclosure to protect users while giving projects time to fix vulnerabilities. Our process includes:
- Private disclosure to affected projects with 90-day remediation window
- Coordination with protocol teams on patch deployment
- Public disclosure only after fix is deployed or deadline expires
- CVE registration for tracking and transparency
To report a vulnerability: security@solcertup.com
Secure Your Protocol
Get your smart contracts audited by the team behind these discoveries