Ten days, 38 teams: what the CoinSec alpha found

What the alpha was

Thirty-eight Solana teams gave us access to their programs, written in Rust, most of them with Anchor. For ten days the attacker ran against that code the way an adversary would: it read each program, tried to break it, and kept only the findings it could prove. A finding counted when the exploit ran on a fork of the chain and did what the attacker said it would. Everything else was discarded before anyone saw it.

Each team got a report: the finding, its severity, the transaction that did it, and the patch we suggested. No scoping calls, no slide decks. Code in, report out.

What it found

More than 200 vulnerabilities across the 38 codebases. Most were not exotic. They were the bugs a careful reviewer finds on a good day and misses at hour six: a signer that is never checked, an account whose owner is never verified, arithmetic that overflows when the numbers get large. The attacker does not get tired at hour six, and it ran on every codebase at once.

The findings that worried teams most were the ones that crossed boundaries: a program that trusted a value another program could change, or an order of operations that was correct in isolation and wrong once the surrounding protocol was taken into account. Those are hard to see when you review one file at a time. They are exactly what an attacker looks for first.

What we learned

Proof is the product. The teams did not thank us for a long list. They thanked us for a short one where every item came with the exploit that demonstrated it. A finding you can run is a finding you can prioritise, hand to an auditor, or close in an afternoon. A finding you have to argue about costs a day before anyone writes a line of code.

Timing matters more than we expected. Several teams had been audited and shipped changes since. The report was a snapshot of code that had moved on, and the bugs were in the parts that moved. That is the case for attacking every change rather than every quarter, and it is what we are building around.

We also made mistakes. Our first reports were too long, and the severity labels on a few findings needed a second look. Both are fixed in the report format we use now.

What comes next

The alpha shaped two ways of running the same attacker. Pulse is the one-off audit the alpha teams got, self-serve, with the proven exploit beside every finding. Orbit watches your repository, attacks each change as it lands, and opens a pull request with the fix and the exploit it closes. Nothing merges without your review.

More than 100 teams are on the waitlist already. If you build on Solana and want the attacker on your code, join the waitlist, or write to us if you would rather talk first.

Thanks to the 38 teams who let us attack their code. The alpha was yours as much as ours.