
The Bugchain challenge presents a simplified blockchain implementation with intentional vulnerabilities. Your task is to identify and exploit these weaknesses, highlighting common pitfalls in blockchain design and implementation.

## Challenge Goals

- Understand core blockchain implementation concepts
- Identify security vulnerabilities in consensus mechanisms
- Learn about proper validation in decentralized systems
- Explore attack vectors against blockchain protocols

Originally presented at ALLES CTF 2021, this challenge offers a unique perspective on blockchain security by focusing on the fundamental structures and mechanisms that can be compromised if not implemented correctly. It provides valuable insights for developers working on custom blockchain solutions. 

Find and exploit bugs in a simplified blockchain implementation built on Solana.

Bugchain


This workshop from PwnedNoMore examines the infamous Cashio protocol exploit that resulted in millions of dollars in losses. By recreating a simplified version of the vulnerability, you'll understand the critical security flaw that led to the hack.

## Workshop Content

- Step-by-step recreation of the Cashio protocol exploit
- Detailed explanation of account validation vulnerabilities
- Hands-on exercises to understand signature verification issues
- Analysis of how proper security checks could have prevented the exploit

The workshop provides valuable insights for Solana developers working on DeFi protocols, highlighting the importance of proper account validation and the risks of insufficient security checks in financial applications. 

Learn about the famous Cashio exploit that led to millions in losses, through a step-by-step workshop recreating the vulnerability.

Cashio Exploit Workshop


Darksols presents a series of Solana security puzzles that progressively test your understanding of smart contract vulnerabilities and exploitation techniques. The challenge is designed to simulate complex security scenarios you might encounter in production environments.

## Challenge Goals

- Identify and exploit complex vulnerabilities in Solana contracts
- Understand advanced program security concepts
- Learn about intricate account relationships and validation
- Develop sophisticated exploit chains for smart contract vulnerabilities

Originally presented at justCTF 2022, this challenge provides a comprehensive test of your Solana security knowledge, requiring both analytical thinking and creative exploitation approaches to overcome its intentionally vulnerable smart contracts. 

Navigate through multiple security puzzles in this Solana smart contract exploitation challenge.

Darksols


The HalbornCTF Solana challenges are created by professional security auditors at Halborn, a blockchain security firm. These challenges reflect real-world vulnerabilities discovered during professional audits, presented in an educational format.

## Challenge Goals

- Learn about security issues from professional auditors' perspectives
- Understand common vulnerabilities identified in production code
- Develop practical skills for identifying security flaws
- Practice exploitation techniques used in professional security assessments

These challenges provide a unique opportunity to learn from security professionals who audit Solana contracts for a living, offering insights into the methods and approaches used by professional security researchers when analyzing smart contract security. 

A series of security challenges designed by professional auditors at Halborn to test Solana smart contract security knowledge.

HalbornCTF Solana


League of Lamports focuses on Solana's account system and secure token handling mechanisms. The challenge tests your ability to identify vulnerabilities in account validation and token operations, which are fundamental to Solana's security model.

## Challenge Goals

- Understand Solana's account validation requirements
- Identify improper validation checks in account handling
- Learn about secure token management practices
- Explore attack vectors related to account and lamport manipulation

Originally presented at justCTF 2022, this challenge highlights the importance of proper account validation and token handling in Solana programs. It addresses one of the most common sources of vulnerabilities in Solana smart contracts, making it highly relevant for practical security applications. 

Test your understanding of Solana's account system and secure token handling in this CTF challenge.

League of Lamports


The Legit Bank challenge simulates a financial application built on Solana, where you'll identify and exploit vulnerabilities in banking operations. This challenge tests your understanding of financial security concepts in blockchain environments.

## Challenge Goals

- Understand account management and security in financial applications
- Identify vulnerabilities in transaction processing systems
- Learn about secure fund management in smart contracts
- Explore common attack vectors against financial protocols

Originally presented at ALLES CTF 2021, this challenge provides valuable insights into the specific security considerations necessary when building financial applications on Solana, including proper validation, transaction handling, and fund protection mechanisms. 

Explore financial security issues in Solana smart contracts through this banking simulation challenge.

Legit Bank


Moar Horse 5 is a challenging exploitation task that targets lower-level Solana program vulnerabilities, with a focus on memory safety and validation issues that can lead to program compromise.

## Challenge Goals

- Identify memory safety vulnerabilities in Solana programs
- Understand the impact of improper input validation
- Learn exploitation techniques specific to the Solana runtime environment
- Develop skills for analyzing program behavior at a low level

Originally presented at TJCTF 2022, this challenge provides advanced insights into Solana security, especially for developers interested in the intersection between traditional application security concepts and blockchain-specific vulnerabilities. 

A unique Solana program exploitation challenge focused on memory safety and validation issues.

Moar Horse 5


These Solana CTF challenges help you learn smart contract security by finding and exploiting vulnerabilities. The collection includes challenges from various competitions and workshops, covering different security concepts in the Solana ecosystem.

## Available Challenges

- **Neodyme Workshop Levels 1-4**: A progressive series of challenges teaching Solana security fundamentals
- **Secret Store**: Learn about data privacy vulnerabilities
- **Legit Bank**: Explore financial contract security issues
- **Bugchain**: Find and exploit bugs in a blockchain implementation
- **Solfire**: Solana contract exploitation challenge
- **Darksols**: Smart contract security puzzle
- **Halborn CTF**: Security challenges from Halborn
- **Moar Horse 5**: Program exploitation challenge
- **Cashio Exploit Workshop**: Based on a real-world exploit
- **Solhana 1-3**: Series of progressive security challenges
- **Pool**: Advanced contract exploitation puzzle
- **League of Lamports**: Account security challenge

Each challenge simulates real-world vulnerabilities to help you understand common security pitfalls when developing on Solana. 

A collection of Solana Capture The Flag (CTF) challenges to learn smart contract security by finding and exploiting vulnerabilities.

Neodyme Solana CTF Challenges


The Pool challenge simulates vulnerabilities in DeFi liquidity pool contracts on Solana. This advanced challenge tests your understanding of complex financial protocols and their potential security weaknesses.

## Challenge Goals

- Understand DeFi liquidity pool implementations on Solana
- Identify security vulnerabilities in complex financial protocols
- Learn about mathematical and logical exploits in financial systems
- Develop skills for auditing sophisticated DeFi applications

Originally presented at Paradigm CTF, this challenge reflects the complexity of real-world DeFi protocols and the security considerations they require. It's particularly valuable for developers working on financial applications in the Solana ecosystem. 

A complex Solana DeFi contract exploitation challenge focusing on liquidity pool vulnerabilities.

Pool


This challenge focuses on the privacy aspects of smart contract data storage on Solana. You'll explore how seemingly private data can potentially be exposed and learn techniques for secure data handling in blockchain environments.

## Challenge Goals

- Understand how data is stored in Solana programs
- Identify common privacy vulnerabilities in smart contracts
- Learn techniques to securely handle sensitive information
- Develop exploitation skills for identifying data leakage

The challenge was originally presented at ALLES CTF 2021 and provides practical insights into the security considerations necessary when handling private data in public blockchain environments. 

Learn about data privacy vulnerabilities in Solana smart contracts through this CTF challenge.

Secret Store


This workshop teaches Solana smart contract security from an attacker's perspective. By finding and exploiting vulnerabilities in prepared contracts, you'll learn to write more secure code and understand what to watch out for.

## Workshop Challenges

- **Level 1 - Personal Vault**: Discover authorization vulnerabilities in a simple vault contract
- **Level 2 - Secure Personal Vault**: Learn about program-derived addresses and security checks
- **Level 3 - Tip Pool**: Find issues in shared funds management
- **Level 4 - SPL-Token Vault**: Explore token-specific security concerns

The workshop provides a simplified framework for creating proof-of-concept exploits, making it accessible even if you're new to Solana security. Each level comes with optional hints if you get stuck. 

Learn Solana smart contract security through hands-on vulnerability exploits in this workshop from Neodyme.

Neodyme Workshop Level 1-4


Solfire is a focused security challenge that tests your ability to identify and exploit vulnerabilities in Solana programs. The challenge simulates real-world security issues commonly found in production smart contracts.

## Challenge Goals

- Identify common vulnerabilities in Solana contract implementations
- Develop exploit techniques specific to the Solana runtime
- Understand program validation and security checks
- Learn about secure program architecture

Originally presented at picoCTF, this challenge helps you build practical skills for auditing and securing Solana smart contracts, with a focus on practical exploitation techniques relevant to real-world scenarios. 

Test your Solana contract exploitation skills in this focused security challenge.

Solfire


Solhana is a series of three progressive challenges that explore different types of vulnerabilities in Solana smart contracts. Each level increases in complexity, introducing new security concepts and exploitation techniques.

## Challenge Goals

- Learn about various vulnerability classes in Solana programs
- Understand how different attack vectors can be exploited
- Progress through increasing levels of security complexity
- Develop a comprehensive understanding of Solana security principles

Originally presented at Paradigm CTF, this challenge series offers a structured approach to learning Solana security, making it ideal for developers who want to systematically improve their understanding of smart contract vulnerabilities and exploitation techniques. 

A progressive series of Solana security challenges focusing on different vulnerability types in smart contracts.

Solhana 1-3


Zero Knowledge is a podcast which goes deep into the tech that will power the emerging decentralised web and the community building this. Covering the latest in zero knowledge research and applications, the open web as well as future technologies and paradigms that promise to change the way we interact — and transact — with one another online.

Zero Knowledge is hosted by Anna Rose

Where we talk about zero knowledge research and the decentralised web

Zero Knowledge


## Overview

Solana's flexible account model enables various approaches to implementing access control and permission systems. This tutorial explores advanced permissioning patterns to secure your Solana programs.

Key topics covered:

- Using PDAs for robust owner/authority checks
- Implementing multi-signature authorities
- Creating role-based access control (RBAC) systems
- Time-locked instructions and transactions
- Fine-grained permission delegation patterns
- Advanced cross-program authority validation
- Upgradeability governance for program security

Well-designed permission systems are critical for Solana program security, especially for protocols managing user funds or sensitive operations. This guide covers both standard approaches and advanced techniques for implementing sophisticated access control mechanisms tailored to different application requirements. 

Learn sophisticated permissioning strategies for Solana programs, including multi-signature authorities, time-locks, and role-based access control systems.

Advanced Permissioning and Access Control in Solana


This tutorial covers the basics of the science of cryptography. It explains how programmers and network professionals can use cryptography to maintain the privacy of computer data. Starting with the origins of cryptography, it moves on to explain cryptosystems, various traditional and modern ciphers, public key encryption, data integration, message authentication, and digital signatures.

This tutorial is meant for students of computer science who aspire to learn the basics of cryptography. It will be useful for networking professionals as well who would like to incorporate various cryptographic algorithms to ensure secure data communication over their networks.

This tutorial has been prepared with the view to make it useful for almost anyone who is curious about cryptography. A basic knowledge of computer science and a secondary level of mathematics knowledge is sufficient to make the most of this tutorial.

This tutorial covers the basics of the science of cryptography.

Learn Cryptography


As most of you probably have some crypto assets on your own, you might have heard of the words ‘public key’ and ‘private key’. In a blockchain network, the public key kind of works as your address. If anyone else in the network wants to send you some funds, he or she is going to send it to your public key. Your private key can be seen as your signature — whenever you like to make a transaction of funds, you prove that you are the one owning the private key belonging to your public key without showing it to anyone in the network. Participants of the network, who check your transaction, can prove that you, with your public key, are the owner of the private key, without even knowing what it is. Pretty cool! But how does this really work on a more fundamental level? Let’s dig a little bit into the theory.

This article gives an introduction to understanding elliptic curve cryptography and coding it.

Learn how to code elliptic curve cryptography


Imagine the following scenario: you just found a critical vulnerability that allows funds in a smart contract to be drained. The exploit, however, is complicated and requires multiple payload parameters to be set correctly for it to be effective or even profitable at all.

It quickly turns out that calculating optimal parameters by hand is infeasible, due to the complex nature of the exploit. And yet, you want to responsibly disclose a Proof of Concept (PoC) that maximizes the amount of funds that can be drained from the contract. Why? Because it’s often true that the greater the funds at risk, the higher the bug bounty reward.

In such a situation, linear programming can be an exceptionally helpful tool. This is an advanced tutorial for whitehats who are looking to take their hacking skills to the next level.

How to Get a Bigger Bounty by Optimizing Attack Parameters

Optimizing Attack Parameters


## Overview

Multisig wallets are essential for secure management of shared funds in organizations, DAOs, and other collaborative entities. This tutorial shows how to build a robust multisig implementation on Solana.

Key topics covered:

- Designing a multisig architecture using Solana's account model
- Creating program-derived addresses (PDAs) for the multisig
- Implementing threshold signature validation
- Building proposal creation and approval workflows
- Transaction execution after threshold approval
- Security considerations and edge cases
- Testing your multisig implementation
- Building a simple UI for multisig management

Multisigs are an essential primitive for securing access to shared accounts. On Solana, multisigs can be implemented efficiently with low fees, making them practical even for smaller organizations. By the end of this tutorial, you'll have a functional multisig wallet that can be customized for various use cases. 

Learn how to implement a secure multisig wallet on Solana using program-derived addresses (PDAs) and threshold signatures for enhanced security and fund management.

Building a Multisig Wallet on Solana


## Overview

Proper validation is essential for secure and reliable Solana programs. This tutorial explores best practices and patterns for implementing robust validation logic to protect against exploits and errors.

Key topics covered:

- Using Rust's Result type for clean error handling
- Creating custom error enums for descriptive errors
- Implementing account validation (owner checks, type checks, PDA derivation)
- Validating numerical operations to prevent overflow/underflow
- Maintaining program invariants across multiple instructions
- Cross-program validation for complex protocols
- Security considerations when validating external inputs

Unlike Solidity's require statements, Solana programs use Rust's native error handling patterns. This tutorial shows how to leverage Rust's type system and pattern matching to create validation that's both secure and maintainable, preventing common vulnerabilities while keeping your code readable. 

Learn best practices for implementing robust validation in Solana programs, from error handling to comprehensive security checks and invariant enforcement.

Validation Patterns for Secure Solana Programs


## Overview

Security is paramount when building blockchain applications that manage user funds and valuable assets. This guide covers essential security considerations specific to Solana program development.

Key topics covered:

- Common attack vectors in Solana programs
- Implementing secure account validation patterns
- Defending against instruction injection attacks
- Secure handling of critical operations and privilege escalation
- Using PDAs correctly for security boundaries
- Preventing double-spending and replay attacks
- Testing and auditing practices for Solana programs
- Post-deployment monitoring and incident response

Solana's unique architecture offers powerful capabilities but also introduces specific security challenges. This guide will help you identify and mitigate these risks, ensuring your programs can securely handle user funds and sensitive operations even under adversarial conditions. 

Learn essential security practices and common vulnerabilities in Solana programs to build robust and secure applications on the Solana blockchain.

Security Best Practices for Solana Program Development


## Overview

Testing is crucial for ensuring the security and reliability of Solana programs. This guide introduces testing approaches and frameworks for comprehensive test coverage in Solana development.

Key topics covered:

- Unit testing Solana programs with Rust's native test framework
- Integration testing with solana-program-test for simulating the Solana runtime
- Using Anchor's testing framework for simplified test setup
- Client-side testing with ts-mocha for frontend integration
- Writing effective test cases for complex program behaviors
- Local validator testing for end-to-end verification
- Test-driven development workflow for Solana projects

Proper testing is essential for Solana development given the immutable nature of blockchain programs and the financial value they often handle. By adopting a test-driven approach, you can catch bugs early, validate your program's behavior, and ensure it functions as expected when deployed to production. 

Learn how to apply test-driven development practices to Solana program development using various testing frameworks and approaches for both on-chain and client-side testing.

Test-Driven Development for Solana Programs


In this series we try to demystify zero-knowledge proofs (ZKPs) for the rest of non-math nerds. Since writing [part 1](https://dev.to/tonyolendo/the-complete-full-stack-guide-to-getting-started-with-zero-knowledge-proofs-using-circom-and-zk-snarks-part-1-53gi), my thoughts on the subject have evolved. I’m more drawn to answering the following questions

- Can anyone be a ZK developer?
- Is there a simple path that we can define for anyone to get started in writing ZK circuits?

The simple answer to all the questions above is yes! Most assuredly, yes. How? Just learn [Circom](https://iden3.io/circom) and you’ll be well on your way.


This tutorial series explains the mechanics of the STARK proof system. It is directed towards a technically-inclined audience with knowledge of basic maths and programming.

Anatomy of a STARK


## Overview

Maximal Extractable Value (MEV) works differently on Solana compared to Ethereum due to fundamental differences in the blockchains' architectures. This guide explains how validators and extractors operate on Solana, the role of priority fees, and how developers can build applications that remain robust in this environment.

Key topics covered:

- How the Solana transaction processing flow enables different MEV extraction mechanisms
- The rise of Jito and MEV extraction infrastructure on Solana
- Priority fee markets and their impact on transaction ordering
- How developers can design applications that minimize MEV vulnerability
- Comparing Solana's MEV landscape with Ethereum's

This tutorial is essential for DeFi developers working on Solana who want to understand the economic implications of their protocol design. 

This tutorial explores Maximal Extractable Value (MEV) on Solana, how it differs from Ethereum, and the implications for users and developers.

Understanding MEV and Validator Extraction on Solana


## Overview

You have 1 SOL in your wallet. You open your wallet app, enter a recipient address, specify the amount, and hit send. A few seconds later, the transaction is confirmed. But what exactly happened during those few seconds?

This tutorial breaks down the entire process of a SOL transfer on Solana, from transaction construction to consensus and finality, including:

- How your wallet constructs the transaction (account addresses, Lamports, signatures)
- How transactions are serialized and sent to the network
- The role of the System Program in processing transfers
- How validators verify, process, and include your transaction in a block
- How Solana's Proof of History and tower BFT consensus ensure transaction finality
- Transaction prioritization and fees on Solana

Understanding this process helps developers build more secure applications and provides deeper insight into Solana's architecture. 

A detailed exploration of Solana's transaction flow, explaining what happens under the hood when you transfer SOL from one wallet to another.

#security

🏆 Cashio Exploit Workshop

🏆 Neodyme Solana CTF Challenges

🏆 Neodyme Workshop Level 1-4

💻 Security Best Practices for Solana Program Development