Master Solana Programs Security.

Hands-on solana programs security wargame. Exploit real vulnerabilities, learn from past hacks, participate on review training and earn verifiable certifications.

levels/01-illusionist/lib.rs

1#[derive(Accounts)]2pub struct DepositTokens<'info> {3    #[account(mut)]4    pub user: Signer<'info>,5 6    #[account(mut)]7    pub vault: Account<'info, TokenAccount>,8 9    #[account(mut)]10    pub user_token_account: Account<'info, TokenAccount>,11 12    pub token_program: Program<'info, Token>,13}

Mission Status

Level 1

Armed

Clusterdevnet

Wallet9xQe...1b2C

PDA stateLive

Win conditionLedger forged

Completion100%

Exploit objective verified. Wallet-bound certification is ready.

research-labs/governance-takeover.rs

1pub fn execute_security_council_action(ctx: Context<AdminAction>) -> Result<()> {2    require!(ctx.accounts.council.threshold >= 2, ErrorCode::Quorum);3 4    let action = ctx.accounts.pending_action.load()?;5    action.execute_without_timelock()?;6 7    ctx.accounts.market.update_oracle(action.oracle)?;8    ctx.accounts.market.enable_collateral(action.mint)?;9 10    Ok(())11}

Research lab

Governance Takeover

Critical

Research social engineering and durable nonce abuse that escalates governance authority.

Review focus: governance flow, transaction freshness, authority boundaries, and proposal execution.

DateApr 1, 2026

Time3-5h

ClassGovernance

Reviewer checklist

Can stale pre-signed governance transactions execute after context changes?

Can two signers authorize critical admin powers without delay?

review-room/finding-target.rs

1pub fn withdraw(ctx: Context<Withdraw>, amount: u64) -> Result<()> {2    let vault = &mut ctx.accounts.vault;3 4    require!(vault.balance >= amount, ErrorCode::InsufficientFunds);5 6    vault.balance -= amount;7    transfer_to_user(ctx.accounts.user.key(), amount)?;8 9    Ok(())10}

Review room

TitleUnchecked CPI targetSummaryThe program lets users choose the CPI target, allowing malicious instructions to run with delegated authority.

SeverityHigh

ImpactMedium

LikelihoodLow

RecommendationAllowlist trusted program IDs and validate CPI accounts before forwarding signer privileges.

Exploit, analyze, and report

Train the fundamentals of security workflow on Solana

CERTIFICATIONS

4 exploits

2 certified

SetupVerifyMint

Exploit Foundations

Interact with vulnerable devnet programs, complete exploit objectives, and unlock wallet-bound certifications.

Governance Takeover Research Lab

Vulnerable

unchecked CPI

static PDA

missing signer

Patched

program guard

user seeds

authority check

Security Research Labs

Study structured research scenarios side-by-side while tracing real-world Solana bug patterns.

Breach Room

Live

Sending review

SeverityImpactLikelihood

Arena & Reviewer Training

Practice professional findings and team review rooms built for onboarding, assessment, and readiness.

Real Vulnerable Programs

Intentionally vulnerable Solana programs deployed on devnet.

Exploit Verification

On-chain objectives with wallet-bound certifications.

Secure Comparisons

Insecure implementations beside patched versions.

Bug Patterns

Arbitrary CPI, PDA misuse, signer confusion, and authority bugs.

Security Writeups

Severity, exploit reasoning, impact, and remediation practice.

Review Rooms

Challenge environments for first-flights, and review writeup training.

Start your Solana security researcher journey today

Open the wargame, inspect vulnerable programs, complete on-chain objectives, and turn each exploit into review-ready proof.

Read Docs