× 
Program security
Program security covers how on-chain code is written, reviewed, audited, and constrained. Its controls span the life of a change, from internal review through external audit to the on-chain safeguards that limit the damage when a flaw reaches production.
Internal review puts a second engineer on every change before it ships. The review examines correctness and security properties, and it leaves a documented record of who approved what.
All code changes undergo security-focused review with documented sign-off before deployment.
Review covers correctness.
Review covers security properties.
External audits bring in reviewers with no attachment to the code. An audit report is evidence about the version it examined. Once the deployed program moves past the audited commit, the report no longer describes what is running.
Independent security firms review critical code paths and major changes.
Findings are tracked to resolution.
Audit scope covers the currently deployed version.
Outside researchers find flaws in deployed programs. Whether a finding reaches the team before it reaches a buyer depends on a published contact, a defined scope, and a committed triage timeline.
An active, monitored bug bounty program with defined scope and severity tiers is in place.
A published security contact with a committed triage timeline is in place.
The program binary includes solana-security-txt metadata with contact, policy, and source URL.
Defense-in-depth mechanisms assume a flaw will reach production despite review and audit. Caps, rate limits, and circuit breakers bound how much an attacker can extract from any single vulnerability before someone intervenes.
On-chain safeguards limit the blast radius of a single vulnerability or compromise.
Rate limits on transfer volume are deployed.
Per-epoch caps are deployed.
Circuit breakers trigger on invariant violations.
Unnecessary composability is removed, for example by disabling CPI on admin instructions.
Graduated withdrawal limits are deployed.
Automated tooling runs in CI/CD on every change, so coverage does not depend on anyone remembering to run it. Fuzzing, static analysis, and property-based testing each catch classes of defects that review misses.
Continuous security tooling in CI/CD detects common Solana vulnerability patterns.
Fuzz testing is in place.
Static analysis is in place.
Property-based testing is in place.
Formal verification is in place.
AI-assisted review is in place.