PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Solana formal verification: a case study

osec.io | blog | #rust | #formal-verification | #solana | #anchor | #kani | #squads
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec presents a framework for formal verification of Solana Anchor programs — autogenerated proof harnesses checked by the Kani verifier — with a Squads multisig case study.
Published
Collected

Related coverage

research · osec.io
Rust, realloc, and references
OtterSec traces a subtle Solana SDK bug in AccountInfo::realloc — unchecked pointer math behind unsafe — explaining BPF loader ABI internals and how the audit uncovered it.
blog · osec.io
Auto reverse-engineering the Hyperliquid risk engine, with some agentic help
OtterSec reverse-engineers Hyperliquid's closed-source risk engine (Rust), showing how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma, aided by agentic tooling.
blog · osec.io
Solana: the hidden dangers of lamport transfers
OtterSec dissects a simple Solana game to expose lamport transfer pitfalls — rent-exemption traps and write-demotion — that can silently fail transfers, brick programs, or crown an eternal king.
blog · osec.io
Solana multisig security
OtterSec examines Solana's signing model — recent blockhash vs durable nonces — and presents a safe-signing procedure for teams whose multisig signers may be compromised.
blog · osec.io
Solana: jumping around in the VM
OtterSec walks through a Paradigm CTF 2023 Solana challenge: using Jump Oriented Programming inside the BPF VM to turn arbitrary call and memory-write primitives into full program control.
blog · osec.io
The Move Prover: a guide
OtterSec's practical guide to the Move Prover: how formal verification works, the pipeline from Move Specification Language to Boogie and Z3, and a real-world case study.
Back