Browse by type
A weekly Solana smart contract security competition — by Frank Castle
The Solana Audit Arena is an open, weekly competition where security researchers audit Solana programs to find as many vulnerabilities as they can.
Every Monday, a new Anchor program is published here. programs are built using the Safe Solana Builder — a security-focused Solana program generator that enforces safe patterns and audit-derived rules. You have one week to find bugs, write a PoC, and submit your findings as a GitHub Issue. The community reviews and discusses every submission publicly. Frank Castle, who is an expert Solana security researcher with 100+ protocol audits, makes the final call on validity and severity.
This exists because security researchers deserve a proving ground. There's no clear path for newcomers to sharpen their skills against realistic Solana codebases, compete on merit, and get noticed. This arena is that path.
| Day | What Happens |
|---|---|
| Monday | New program published → Announcement post on X with link to this repo |
| Monday–Sunday | Open submission window → Submit findings as GitHub Issues |
| Following Monday | Frank validates, scores, and posts results on X → New program announced |
Submit each finding as a separate GitHub Issue in this repository.
[Week X] [Severity] Short descriptive title
Example: [Week 3] [Critical] Unauthorized withdrawal via missing signer check in unstake()
Use this template exactly — issues that don't follow the format will be tagged invalid-format and won't be scored until corrected (eating into your submission window).
## Finding
**Week**: [NUMBER]
**Researcher**: [Your GitHub handle + X handle]
**Severity**: [Critical / High / Medium / Low / Informational]
**Category**: [e.g., Missing signer check, Arithmetic overflow, PDA seed collision, CPI validation, etc.]
**Affected function**: [instruction name or function]
## Description
[Clear explanation of the vulnerability — what's wrong and why it matters]
## Impact
[What can an attacker do? Quantify if possible — e.g., "drain all vault funds", "bypass admin check"]
## Proof of Concept
- REQUIRED
[Provide a concrete PoC that demonstrates the exploit. This can be:]
- A TypeScript/Rust test that triggers the vulnerability
- A step-by-step transaction sequence with account setups
- A code diff showing the exact exploit path with expected vs actual behavior
[The PoC must be detailed enough that someone can independently verify the vulnerability without guesswork.]
## Recommended Fix
[How to patch it — include code if possible]
Issues will be labeled by Frank Castle during judging:
| Label | Meaning |
|---|---|
valid |
Confirmed vulnerability, scored |
invalid |
Not a real vulnerability |
duplicate |
Same finding submitted earlier by another researcher |
invalid-format |
Doesn't follow the submission template |
critical / high / medium / low |
Final severity assigned by judge |
best-find |
Best finding of the week |
week-N |
Which week the finding belongs to |
Every submission is public. This is intentional.
| Severity | Points |
|---|---|
| Critical | 10 |
| High | 7 |
| Medium | 3 |
| Low | 1 |
| Informational | 0 (acknowledged but no points) |
duplicate and score 0.invalid-format and won't be scored. No exceptions — if you can't prove it, it's not a finding.The all-time leaderboard is maintained in LEADERBOARD.md in this repository and updated every Monday with the week's results.
Each week, the results post on X will feature: - Top 3 researchers of the week - Best finding of the week (most creative or impactful) - Rising researcher — biggest improvement from a newer participant
All submissions receive their final judgment from Frank Castle (@0xcastle_chain), informed by community discussion.
Frank has audited 100+ protocols and 50+ Solana programs, identifying 300+ high and critical severity vulnerabilities. Previous engagements include Cantina, Spearbit (Senior Researcher), and Pashov Audit Group.
Q: I'm a complete beginner. Can I participate? A: Absolutely. That's who this is for. You'll learn more from one week of trying to break a real program than from months of tutorials. Even if you find 0 bugs your first week, you'll learn from reading other people's submissions.
Q: Do I need to be a Rust expert? A: You need to be able to read Rust and understand Solana's account model. If you can follow an Anchor program's logic, you're ready.
Q: Is there a cost to participate? A: No. Free. Always.
Q: Can I use AI tools to help me audit? A: Yes — but you must understand and validate every finding you submit. Raw scanner output without analysis will be rejected. If you use AI as a starting point and then verify and explain the finding yourself, that's fair game. Your PoC still needs to work.
Q: Will programs get harder over time? A: Yes. Early programs will have more obvious bugs. As the community levels up, so will the complexity.
Q: How do I get the "join a private audit" prize? A: Be the leading researcher on the all-time leaderboard at evaluation points (announced in advance). This isn't just about points — consistency, finding quality, and demonstrated growth all factor in.
Q: Won't public submissions let people copy each other?
A: Timestamps matter. First valid submission gets the points. If someone submits after you with the same finding, they get labeled duplicate. This actually rewards speed and confidence — submit when you're sure, don't wait.
Q: Can I comment on other people's submissions? A: Yes — that's the point. Community review makes everyone better. Challenge PoCs, suggest better fixes, confirm findings. Just be constructive.
Built by Frank Castle. Securing Solana, one researcher at a time.
$ claude mcp add Solana-Audit-Arena \
-- python -m otcore.mcp_server <graph>