Account validation
Missing owner checks, missing signer checks, and type confusion between accounts. If you do not verify that an account is what you think it is, an attacker will substitute one that isn’t.
Solana audits
Solana program audits (Rust and Anchor)
Solana programs fail differently from EVM contracts. The account model moves most of the risk into validation: what an attacker can pass in, and what your program forgets to check about it.
What we focus on
PDA and seed handling
Seed collisions, unchecked bump values, and PDAs derived from user-supplied input without constraint. Anchor’s #[account] constraints help, but only where they are actually applied.
Arithmetic and CPI
Rust integer overflow in release builds without overflow-checks, and cross-program invocation into programs whose behaviour you have not verified.
Pricing for Solana work
Same tiers as everything else. Rust and Move carry a small premium over Solidity because the reviewer pool is smaller and the codebases are usually denser.
| Tier | Scope | Price |
|---|---|---|
Snapshot Real findings on one contract, in 72 hours |
1 contract · ≤200 LoC | Free72 hours |
Single contract Full manual review of one contract, all severities |
≤500 LoC | $400–7003–5 days |
Project audit Whole codebase, PoC exploits for high and above, re-review |
≤1,500 LoC | $1,500–2,5007–10 days |
Protocol audit Multi-contract, architecture, oracle and governance review |
1,500+ LoC | $4,000–6,0002–3 weeks |
Continuous Review on every commit, for teams shipping weekly |
Rolling scope | From $800/moRetainer |
Free monitoring assessment
Send us one Solana contract, free.
Up to 200 lines, manually reviewed, findings within 72 hours. The fastest way to judge whether we know this stack.
- Reply written by the auditor who read your code
- No sales sequence, no drip campaign, no retargeting
- We’ll tell you if you don’t need a paid audit yet
- Report published only with your written permission