solana-defi-vulnerability-analyst-agent
Solana DeFi vulnerability analyst agent
Role overview
Structured workflow for Solana program and DeFi risk analysis: Rust (Anchor or native), accounts, PDAs, CPI boundaries, liquidity and oracle dependencies, and SPL token rules—grounded in verified source when available, on-chain account layout and historical transactions for everything else.
Scope: defensive triage, reproducible findings, and safe validation paths (local validator, devnet, read-only mainnet inspection)—not weaponized exploits, mainnet attacks, or bypassing access controls.
This skill does not replace a professional smart-contract audit or formal bug-bounty process. For cross-ecosystem DeFi triage (including EVM), use defi-security-audit-agent. For EVM Solidity-first triage, evm-solidity-defi-triage-agent. For transaction-level tracing and inner-instruction maps, use solana-tracing-specialist. For flash-loan / atomic exploit post-mortems (historical txs, impact, read-only simulation), use flash-loan-exploit-investigator-agent. For honeypot-style transfer and sell restriction patterns on SPL / Token-2022, use honeypot-detection-techniques. For signer, governance, and durable-nonce mitigation patterns (public case studies such as Chainalysis on Drift), use defi-admin-takeover-mitigation-lessons.
Do not request private keys or confidential program data. Do not provide step-by-step instructions to steal user funds on mainnet.
1. Solana program code review and static analysis
- Obtain verified source from explorers or repos when possible; for closed-source programs, use disassembly / layout analysis with explicit limits on certainty.
- Anchor — Read
#[account]constraints, signer / mut / owner checks, bump seeds, realloc and init paths; map instruction discriminators from IDL or raw data. - Native Rust — Manual
AccountInfovalidation: missing signer checks, owner checks, rent and close discipline, sysvar misuse, zero-copy layout safety. - PDA — Seed composition, bump canonicalization, program ownership of derived accounts; watch for seed collisions and cross-program confusion if PDAs are reused or ambiguously named.
- Upgradeability — Identify program data / upgrade authority; who can deploy new bytecode?
More from agentic-reserve/blockint-skills
evm-solidity-defi-triage-agent
Guides EVM Solidity DeFi triage from public verified source or bytecode—access control, proxies, oracle usage, reentrancy and CEI patterns, DEX/router integrations, and common vulnerability classes. Use when the user asks for Ethereum or L2 smart contract security review, Solidity audit triage, OpenZeppelin proxy risks, or EVM-specific DeFi patterns—not for live exploits or private keys.
10crypto-market-structures
Summarizes descriptive concepts for max pain options theory, covered-call style crypto ETFs, crypto arbitrage families and risks, and bull/bear flag chart patterns—always as non-prescriptive education. Use when the user asks about max pain, premium income ETFs, arbitrage, funding rates, flash loans, or bull/bear flags in crypto trading context.
10honeypot-detection-techniques
Educational techniques to assess honeypot-style token risk from verified source, bytecode clues, and observational on-chain history—EVM ERC-20 patterns (transfer gates, fees, blacklists), Solana SPL and Token-2022 hooks, and safe validation paths. Use when the user asks how to detect honeypots, sell-restricted tokens, scam token mechanics, or static review checklists—not for deploying scams, stealing funds, or advising high-risk mainnet test trades on unknown contracts.
10katana-web-crawling
Guides use of ProjectDiscovery Katana for web crawling and spidering in security testing and recon workflows. Covers installation, standard vs headless mode, scope and rate limits, JSONL output, and piping from httpx or URL lists. Use when the user mentions Katana, projectdiscovery/katana, web crawling, spidering, endpoint discovery, attack surface mapping, or chaining crawlers in automation pipelines.
10crypto-investigation-compliance
Maps high-level crypto crime categories, safe and ethical OSINT plus on-chain investigation workflow, and victim reporting posture. Use when the user asks about scam types, pig butchering, rug pulls, tracing stolen funds ethically, compliance-adjacent investigation, or how to document cases for authorities.
10solana-tracing-specialist
Guides Solana-specific on-chain forensics—ATA resolution, SPL instruction parsing, transaction history via RPC and indexers (e.g. Helius-style APIs), fund-flow graphs, Solana clustering heuristics, and program authority review. Use when the user investigates Solana wallets, SPL tokens, DEX/Jito flows, rug or phishing patterns on Solana, or needs evidence-structured tracing reports with public data only.
10