One audit.
Every finding proven.
Submit your Solana program and get back an audit with a working exploit beside every finding. Self-serve, no sales call.
A working exploit, not a pattern match
Every finding is confirmed on a fork of the chain before it goes in the report. If CoinSec can't exploit it, it doesn't report it.
A report you can hand over
Each finding with its severity, the transaction that did it and the suggested fix. Your team works from it, and so can your auditors.
Self-serve
Point CoinSec at the program and wait for the report. No scoping call and no weeks on an auditor's calendar.
From program to report,
with the exploit for every finding.
Submit your program
Point CoinSec at the repository. Solana programs in Rust, with or without Anchor.
The attacker goes to work
It reads the program the way an adversary does and tries to break it: signer checks, account validation, arithmetic, and the patterns it learned from the last exploit it found.
Read the report
Each finding comes with the proven exploit, a severity you can act on and the patch that closes it.
New scan
QueuedRepository
github.com/yourteam/vault
Programs found
vault, staking
Framework
Anchor
Attacking vault
Runningwithdraw
missing signer check
init_vault
unchecked account owner
collect_fees
arithmetic overflow
close_account
re-initialisation
Audit report
vault · 3 findingsMissing signer check on withdraw
exploit · transaction · patch
Unchecked owner on init_vault
exploit · transaction · patch
Overflow in collect_fees
exploit · transaction · patch
When to run a Pulse
Before a launch or an upgrade, to find what a manual audit should look at first.- Before you book an audit, so the auditors start from a list of proven exploits instead of a blank page.
- For a second opinion on a program that has already been audited.
Pulse is part of the CoinSec beta, which is opening to Solana teams in batches. Shipping every week? Orbit runs the same attacker on every change.