PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Solana multisig security

osec.io | blog | #multisig | #solana | #wallet-security | #transaction-signing | #durable-nonce | #key-compromise
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec examines Solana's signing model — recent blockhash vs durable nonces — and presents a safe-signing procedure for teams whose multisig signers may be compromised.
Published
Collected

Related coverage

blog · osec.io
Solana: the hidden dangers of lamport transfers
OtterSec dissects a simple Solana game to expose lamport transfer pitfalls — rent-exemption traps and write-demotion — that can silently fail transfers, brick programs, or crown an eternal king.
blog · osec.io
Solana: jumping around in the VM
OtterSec walks through a Paradigm CTF 2023 Solana challenge: using Jump Oriented Programming inside the BPF VM to turn arbitrary call and memory-write primitives into full program control.
blog · osec.io
Solana formal verification: a case study
OtterSec presents a framework for formal verification of Solana Anchor programs — autogenerated proof harnesses checked by the Kani verifier — with a Squads multisig case study.
blog · osec.io
Reverse engineering Solana with Binary Ninja
OtterSec open-sources a Binary Ninja plugin for blackbox Solana program analysis, plus a runtime primer covering eBPF ELF layout, memory model, transactions and instructions.
blog · osec.io
The story of the curious rent thief
OtterSec investigates a bot stealing rent from uninitialized Solana accounts, via a case study of an attack on Solend's permissionless pools exploiting the creation-initialization gap.
blog · osec.io
Becoming a millionaire, 0.000150 BTC at a time
OtterSec found a rounding issue in the Solana Program Library's stable swap, letting attackers extract one token per instruction across pools worth over $700M in combined value.
Back