(Not So) Smart Contracts

This repository contains examples of common Solana smart contract vulnerabilities, including code from real smart contracts. Use Not So Smart Contracts to learn about Solana vulnerabilities, as a reference when performing security reviews, and as a benchmark for security and analysis tools.


Each Not So Smart Contract includes a standard set of information:

  • Description of the vulnerability type
  • Attack scenarios to exploit the vulnerability
  • Recommendations to eliminate or mitigate the vulnerability
  • Real-world contracts that exhibit the flaw
  • References to third-party resources with more information


Not So Smart ContractDescription
Arbitrary CPIArbitrary program account passed in upon invocation
Improper PDA ValidationPDAs are vulnerable to being spoofed via bump seeds
Ownership CheckBroken access control due to missing ownership validation
Signer CheckBroken access control due to missing signer validation
Sysvar Account CheckSysvar accounts are vulnerable to being spoofed
Improper Instruction IntrospectionProgram accesses instruction using absolute index


These examples are developed and maintained by Trail of Bits.

If you have questions, problems, or just want to learn more, then join the #solana channel on the Empire Hacking Slack or contact us directly.