Sec3

@sec3dev

Full Stack Security: Protection at every step of the development cycle. Security Partner of @Metaplex, @Orca_so, @KaminoFinance, & many more!

Secure your protocol 👉

linktr.ee/sec3

Joined September 2021

289 Following

6,266 Followers

Replies Reposts Media

Pinned
Sec3
@sec3dev
Apr 6
A recent major Solana exploit made the problem clear: not every protocol drain starts with buggy code. Some attacks rely on on-chain staging before execution: durable nonce activity and multisig governance changes. We added 3 free WatchTower monitoring bots for Solana protocols
Sec3 WatchTower: Free on-chain monitoring for nonce and multisig attack staging
From wt.sec3.dev
4
Sec3
@sec3dev
Jul 7
If there are areas of the protocol where your team wants extra review, tell us early. That could be a new integration, a sensitive admin flow, complex accounting logic, or an assumption you want validated before launch. We will still review the full agreed scope. But knowing where the team wants deeper attention helps us allocate review time where it matters most.
1
Sec3
@sec3dev
Jun 30
A useful pre-audit exercise for Solana teams: Pick every CPI in the codebase and write down what your program assumes before and after the call. Before: - which program is being called? - which accounts are passed through? - which signer or writable privileges are being
Sec3
@sec3dev
Jun 23
Before a Solana audit, make an account map for each instruction. For every account, write down: - who owns it - who can sign for it - whether it must be writable - which PDA seeds derive it - which token mint or authority it depends on - how it relates to the other accounts in
1
Sec3
@sec3dev
Jun 16
The riskiest key in a Solana protocol is not always the upgrade authority. Sometimes it is the key that can change a market parameter, rotate an oracle, pause withdrawals, update fees, or move treasury funds. Before launch, teams should be able to answer a simple question: If this signer is compromised once, what can actually happen?

Sec3

Sec3’s posts