-
- more general blockchain than solana-specific
-
Soteria Series on Auditing
-
Armani Tweets about security
-
- Common malpractices (broken into secure, insecure, recommended)
- Tweet thread breakdown https://twitter.com/pencilflip/status/1483880018858201090
-
Neodyme Solana Common Pitfalls
- Give hints to the Workshop exercises
-
Saber Library for basic security checks
- has asserts and other testing primitives. Some things are deprecated because automatically part of Anchor
-
- Some account validation examples, uses vipers.
-
- Assertion instruction included on client-side/wallets, allows safe failure if unexpected result
-
Soteria Series on Internals
- Neodyme Breakpoint Workshop
- CTF style
- Neodyme Breakpoint Workshop Video
- Goes over exercise 0 of Neodyme Breakpoint Workshop
- TJCTF 2022 Moar-Horse-5
- CTF Solana challenge
- PicoCTF 2022 Solfire
- CTF Solana challenge
- spl-token lending protocol exploit (neodyme)
- spl-token-swap rounding exploit (osec)
- Jet hack
- Cope Pierre Hack
- Wallet simulation rug pull
- Why Magic Eden is garbage Tweet
- transferring token authority from user to magic eden
- solana-labs/solana-program-library#2640
- Wormhole Hack
- call complete_wrapped (instruction 03)
- post_VAA (instruction 02) called on main bridge
solana_program::sysvar::instructions
not verified in this vesion of solana_program- https://twitter.com/wireless_anon/status/1489075372662476800?s=20&t=XHV8n8c4DJOBzcKwzAqunw
- unmerged PR to fix issue: https://github.com/certusone/wormhole/commit/7edbbd3677ee6ca681be8722a607bc576a3912c8#diff-0d27d8889edd071b86d3f3299276882d97613ad6ab3b0b6412ae4ebf3ccd6370L92-R101
- Soteria Bug report on solana stake pool
- Potential Solana attack vector on ERC-20 approve (Actually happened to Solfire victims)
- exchgART hack
- Archive thread
- drained funds in offer accounts. But refunded.
- Jet 20m bug report
- Serum v4 bug
- Serum Zero day
- Cashio hack (Soteria)
- Cheating Oracles on Solana
- Solana Core seed collision (Neodyme)
- Zellic Postmortem of Drift
- Integer overflow in rBPF
- Please make any PR's or tweet @kevinchow23 for more additional resources/hack reports
- Internet archive posts + tweets