new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Solana & Anchor Auditor · all subjects

Real incidents

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

How did the Wormhole $326M exploit actually work?

Wormhole (Feb 2022, ~$326M / 120k wETH) is the canonical Solana sysvar-verification failure — NOT an EVM-style bug. The bridge's `verify_signatures` instruction was supposed to read secp256k1 signature-verification results written by the native secp256k1 program into the INSTRUCTIONS SYSVAR account. The vulnerable code accepted a sysvar account passed by the caller without verifying it was the genuine instructions sysvar address (the deprecated `load_instruction_at` path trusted the account). The attacker passed a fake account they owned, populated with spoofed "secp256k1 program verified these guardian signatures" output, creating a forged `SignatureSet`. `post_vaa` then accepted it, `complete_wrapped` minted 120,000 wETH on Solana unbacked by locked ETH. Lesson: every account standing in for system truth must be address-verified — and "the runtime checks sysvars now" doesn't cover program-level trust in account contents.

How did Cashio's missing collateral validation enable infinite mint?

Cashio (March 2022, ~$48M, CASH stablecoin depegged to zero) is the canonical fake-collateral / incomplete-validation bug. Minting CASH required depositing Saber LP tokens as collateral through a "crate" (collateral basket). The validation chain checked the crate token's mint but failed to validate the full dependency graph — specifically, it never verified that the Saber swap underlying the LP token was the legitimate, expected one (the `saber_swap_arrow` / underlying mint relationship went unchecked). The attacker created a worthless new token, built a fake Saber pool around it, wrapped it into a crate that passed the partial checks, deposited this valueless collateral, and minted billions of CASH, then dumped it into real liquidity. Lesson: on Solana, validating ONE link in an asset's provenance chain is validating nothing — walk mint → token account → LP → underlying pool to canonical addresses.

How did Crema Finance lose $8.8M to a fake account?

Crema Finance (July 2022, ~$8.8M) is the canonical unverified-oracle-account attack on Solana. Crema is a concentrated-liquidity AMM whose flash-loan fee accounting relied on a "tick" account — the current price tick — passed in by the caller. The program failed to verify that the supplied tick account was the genuine, program-derived account (owner and address validation missing). The attacker created their own account with fabricated tick data, took a flash loan, and the spoofed tick made the protocol compute near-zero fees / accept the manipulated price state, letting them repay cheaply and drain the difference across pools; they later negotiated and returned most funds for a bounty. Lesson: any account carrying pricing/accounting truth must be either a program-derived PDA with checked seeds or address-pinned in stored config — "caller supplies the oracle" is a red flag on its own.

How did Mango Markets get drained via oracle manipulation?

Mango Markets (October 2022, ~$114M, Avraham Eisenberg — later convicted of fraud) is the canonical oracle-manipulation-of-illiquid-collateral case, and it's economic, not a code bug. MNGO was a thin-liquidity governance token usable as collateral on Mango, with its mark price derived from spot prices on exchanges where MNGO barely traded. The attacker funded two accounts, built a large MNGO perpetual long between them, then aggressively bought MNGO on the external venues feeding the oracle, pumping the spot price ~10x in minutes. The inflated collateral value let one account "borrow" (withdraw) essentially all liquid assets on the platform; the position was never going to be liquidatable at real prices. Lesson for Solana auditors: collateral eligibility, oracle source liquidity, borrow caps per-asset, and price-impact assumptions are SECURITY parameters — review them as code, not tokenomics.

What does the Slope wallet hack teach protocol auditors?

Slope (August 2022, thousands of Solana wallets drained, ~$4-8M across users) was NOT a program exploit: Slope's mobile wallet logged users' plaintext seed phrases to its Sentry telemetry backend; anyone with access to that logging pipeline could reconstruct keys. It matters to this brain because the same lesson generalizes to protocol operations: key custody and operational hygiene dominate Solana loss events even when programs are correct — upgrade authorities on hot keys, multisigs with co-located signers, CI machines holding deployer keys. When auditing a Solana protocol, enumerate the OFF-CHAIN key surface: program upgrade authority, PDA admin multisigs, oracle update keys, crank/keeper keys with spending power, and any backend that touches serialized keypairs. A formally perfect program with its upgrade key in a GitHub Action secret is a critical finding, not an informational one.

Give your agent this brain