Sec3

@sec3dev

Full Stack Security: Protection at every step of the development cycle. Security Partner of @Metaplex, @Orca_so, @KaminoFinance, & many more!

Secure your protocol 👉

linktr.ee/sec3

Joined September 2021

Pinned
Sec3
@sec3dev
Apr 6
A recent major Solana exploit made the problem clear: not every protocol drain starts with buggy code. Some attacks rely on on-chain staging before execution: durable nonce activity and multisig governance changes. We added 3 free WatchTower monitoring bots for Solana protocols
Sec3 WatchTower: Free on-chain monitoring for nonce and multisig attack staging
From wt.sec3.dev
Sec3
@sec3dev
Jul 7
If there are areas of the protocol where your team wants extra review, tell us early. That could be a new integration, a sensitive admin flow, complex accounting logic, or an assumption you want validated before launch. We will still review the full agreed scope. But knowing
Sec3
@sec3dev
Jun 30
A useful pre-audit exercise for Solana teams: Pick every CPI in the codebase and write down what your program assumes before and after the call. Before: - which program is being called? - which accounts are passed through? - which signer or writable privileges are being
Sec3
@sec3dev
Jun 23
Before a Solana audit, make an account map for each instruction. For every account, write down: - who owns it - who can sign for it - whether it must be writable - which PDA seeds derive it - which token mint or authority it depends on - how it relates to the other accounts in
Sec3
@sec3dev
Jun 16
The riskiest key in a Solana protocol is not always the upgrade authority. Sometimes it is the key that can change a market parameter, rotate an oracle, pause withdrawals, update fees, or move treasury funds. Before launch, teams should be able to answer a simple question: If