FIELD MANUAL

[ LABS · LEARN BY HUNTING ]

A Solana security curriculum: foundations first (the account model every bug exploits), then eleven vulnerability classes — each lab shows the vulnerable code, the fix, the real-world exploit it caused, and lets you unleash the pack on it. No slides.

TIER 0 · FOUNDATIONS
read these first — the mental model every vuln class exploits
The Account ModelLESSON
foundations
Signers & Writable FlagsLESSON
foundations
Ownership = TrustLESSON
foundations
PDAs — Program Derived AddressesLESSON
foundations
CPI — Cross-Program InvocationLESSON
foundations
How the Pack HuntsLESSON
methodology
TIER 1 · THE ACCOUNT MODEL
where Solana bugs live: who signed, who owns, what the bytes mean
Missing Signer CheckPACK-PROVEN
signer-authorization · 0-signer-authorization
Account Data Matching
account-data-matching · 1-account-data-matching
Owner Checks
owner-checks · 2-owner-checks
Type Cosplay
type-cosplay · 3-type-cosplay
TIER 2 · CPI & PDAs
cross-program trust, derived addresses, and the edges between them
Reinitialization
reinitialization · 4-initialization
Arbitrary CPIPACK-PROVEN
arbitrary-cpi · 5-arbitrary-cpi
Duplicate Mutable Accounts
duplicate-mutable-accounts · 6-duplicate-mutable-accounts
Bump Seed Canonicalization
bump-seed-canonicalization · 7-bump-seed-canonicalization
PDA Sharing
pda-sharing · 8-pda-sharing
TIER 3 · LIFECYCLE & SYSVARS
account death, revival, and forged runtime inputs
Closing Accounts & RevivalPACK-PROVEN
closing-accounts · 9-closing-accounts
Sysvar Address Checking
sysvar-address-checking · 10-sysvar-address-checking
lab programs from coral-xyz/sealevel-attacks (Apache-2.0) — insecure / secure / recommended variants