solana-auditor

The fragment is not executable but constitutes a high-risk attacker-oriented blueprint. It should be treated as a potential supply-chain risk if included in a library or docs, requiring strict controls, access restrictions, and explicit guidance to avoid embedding exploit-oriented patterns in production code or educational materials without proper safeguards.

The provided fragment is a governance/guidance document with attacker-oriented framing. It does not perform malware or business logic activity, but its mindset could enable aggressive, non-evidence-based auditing workflows if adopted uncritically. Treat as a high governance risk and ensure defender-focused tooling and reviews to prevent weaponization of findings.

The skill is coherent with its stated purpose and shows no clear credential theft or covert exfiltration. However, it is a high-risk AI security-auditing capability: it orchestrates multi-agent smart-contract analysis using attack-vector guidance, processes untrusted code at scale, and retains shell/file-write abilities. The remote GitHub VERSION check is low-to-moderate supply-chain risk, but the main concern is the intentional enablement of AI-driven security review/exploit analysis.

This artifact is an explicit, high-risk attacker playbook for economic/DeFi exploitation. It enumerates realistic, actionable techniques (oracle manipulation, token behavior abuse, CPI substitution, lamport/dust manipulation, capacity exhaustion, atomic extraction) that can lead to direct financial loss or denial-of-service when target programs lack standard defenses. Projects using external oracles, CPIs, token features, or global caps should treat this as a credible threat model and implement mitigations: validate CPI program IDs, enforce oracle freshness/confidence/decimals, reload account state after CPI, account for actual received token amounts, favor per-user caps or rate limits, and avoid business logic that depends on mutable lamport values. The document itself is not executable malware but is highly actionable malicious guidance; remediation and threat modeling are recommended.

The fragment is a high-risk attacker playbook for exploiting arithmetic and precision bugs in financial smart contracts (Rust/Solana). It contains actionable steps that would enable an attacker to find and weaponize rounding, truncation, cast, and overflow issues. Although not executable code, its presence in a repository is dangerous and warrants immediate review and removal or restriction; code implementing the described calculations should be audited for the enumerated defects (wrong rounding directions, unsafe 'as' casts, saturating ops misuse, disabled overflow checks, float use, and decimal mismatches).

This document is a high-risk attacker playbook describing multiple concrete execution-flow exploit techniques against Solana programs. It should be treated as malicious guidance: it identifies common programming mistakes (serialization issues, sentinel reliance, ignored CPI results, stale AccountInfo use, remaining_accounts misuse, account close/revive) and explains how to abuse them to steal funds or corrupt state. There is no benign library code here; inclusion of this content in a package (especially if coupled with test harnesses, example programs, or scripts) is a serious red flag. Remediation: audit programs for the exact patterns described, add strict validation, re-deserialize after CPI, validate remaining_accounts owners/layout, propagate CPI errors, and avoid trusting sentinel values.

The submitted text is a deliberate attacker guide aimed at compromising supply-chain trust via subtle bugs in utility modules. It is malicious in intent and maps to realistic, high-impact attack patterns (PDA collisions, serialization corruption, CPI redirection, compute exhaustion). No concrete code is provided to prove exploitation, but the presence of this guidance in a project is a critical security concern that justifies immediate repository-wide audit and incident response.