Security Checklist for Solana Developers

0 of 78 completed (0%)

Account Validation

Verify account owner matches expected program ID

critical

Check account discriminator to ensure correct account type

critical

Validate signer status for accounts that should authorize actions

critical

Check writable flag for accounts that will be modified

critical

Verify account is initialized before reading data

critical

Validate account data length matches expected size

critical

Check that accounts are not closed (lamports = 0)

critical

Verify rent-exempt status for accounts that should persist

important

PDA Security

Use consistent seeds for PDA derivation across program and client

critical

Store bump seed in account data to avoid recalculation

critical

Validate PDA derivation on-chain, don't trust client-provided PDAs

critical

Use create_program_address for validation, not find_program_address

important

Include unique identifiers in seeds to prevent collisions

critical

Document seed structure clearly for maintainability

important

Use canonical bump (the one from find_program_address)

critical

Keep total seed length under 32 bytes

important

Token Operations

Verify token account mint matches expected token

critical

Check token account owner is the expected user/PDA

critical

Validate token program ID (SPL Token vs Token-2022)

critical

Account for token decimals in all calculations

critical

Check token account is not frozen before transfers

important

Verify associated token account derivation

critical

Handle close authority properly for token accounts

important

Check delegate and delegated amount for token accounts

important

Arithmetic Safety

Use checked arithmetic (checked_add, checked_sub, checked_mul)

critical

Handle division by zero explicitly

critical

Consider precision loss in division operations

critical

Round in protocol's favor, not user's favor

critical

Use saturating arithmetic where appropriate

important

Validate numeric inputs are within expected ranges

critical

Use fixed-point math for financial calculations

critical

Test edge cases with minimum and maximum values

critical

CPI Security

Validate target program ID before CPI

critical

Use hardcoded program IDs, not account-provided ones

critical

Pass correct signer seeds for PDA-signed CPIs

critical

Follow checks-effects-interactions pattern

critical

Update state before making CPIs to prevent reentrancy

critical

Check CPI return values for success

critical

Limit CPIs to known, audited programs

critical

Document CPI trust assumptions

important

Access Control

Implement proper authority checks for admin functions

critical

Use multi-sig or governance for critical operations

critical

Implement upgrade authority controls

critical

Add timelock for sensitive parameter changes

important

Document all privileged operations

important

Allow authority transfer/revocation

important

Validate authority accounts are signers

critical

Consider program freezing for emergencies

important

State Management

Initialize all account fields explicitly

critical

Use proper serialization/deserialization

critical

Handle account resizing carefully

important

Clean up closed accounts properly

important

Prevent duplicate initialization

critical

Use version field for future migrations

important

Validate state transitions are valid

critical

Document account lifecycle

important

Clock and Timing

Use Clock sysvar for timestamps, not block data

critical

Handle i64 timestamps correctly (not u64)

important

Consider slot vs Unix timestamp based on precision needs

important

Account for clock skew in time-sensitive operations

important

Don't trust future timestamps from users

critical

Implement reasonable timelock durations

important

Testing

Write detailed unit tests with Bankrun

critical

Test on devnet with realistic conditions

critical

Test all error paths, not just happy paths

critical

Use fuzzing (Trident) for complex logic

important

Test with invalid account inputs

critical

Test arithmetic edge cases

critical

Test CPI failure scenarios

important

Verify compute unit usage under load

important

Deployment

Verify program builds are reproducible

critical

Use verified builds on-chain

important

Store upgrade authority securely (multi-sig)

critical

Test upgrade procedure before mainnet

critical

Document deployment and upgrade process

important

Consider making program immutable after stabilization

important

Monitor program after deployment

critical

Have incident response plan ready

critical

Key Recommendations

Account validation is the most common source of Solana vulnerabilities. Check every account constraint.

Test with the exact version of the Solana CLI you will deploy with.

Use Anchor constraints (has_one, constraint) instead of manual checks.

More Guides for Solana Developers

Checklist

Solana Program Deployment Checklist

Project Ideas

50 Portfolio Project Ideas for Solana Developers

Common Mistakes

30 Common Mistakes Solana Developers Make (And How to Avoid Them)

Tools Directory

30 Essential Tools for Solana Developers

Looking for Web3 Opportunities?

Explore curated, high-impact roles across top blockchain protocols and Web3 startups.

Back to All Resources

Security Checklist for Solana Developers

Account Validation

PDA Security

Token Operations

Arithmetic Safety

CPI Security

Access Control

State Management

Clock and Timing

Testing

Deployment

Key Recommendations

More Guides for Solana Developers

Related Reading

Looking for Web3 Opportunities?