Anatomy of a Solana program.
A Hack Your Future lesson: build what’s next, and build it securely. Reading a smart contract the way an attacker does.
The whole lesson in about five minutes. Captions are on the picture and music is built in. Press the speaker button for sound. Also available: the dark version for projecting and subtitle files for the light and dark videos.
The fix in one struct
#[derive(Accounts)]
pub struct Withdraw<'info> {
#[account(
mut,
seeds = [b"vault", authority.key().as_ref()],
bump = vault.bump,
has_one = authority,
)]
pub vault: Account<'info, Vault>,
#[account(mut)]
pub authority: Signer<'info>,
}
Two constraints tie the vault to its signer: seeds and has_one. Remove them and anyone who can sign can withdraw from any genuine vault.
Welcome. Let’s read a smart contract like an attacker.
The program is a tip vault: about ninety lines of Rust, written with Anchor. Its promise is simple. Anyone can tip into a vault, but only its owner can withdraw.
Over the next few minutes we’ll find the exact lines that make that promise true, and then we’ll break one. You can watch the five-minute walkthrough, follow the slides, or jump straight into the demo and play the attacker yourself.
Make a prediction. Before the demo you’ll be asked: if we delete the constraints from Withdraw, who can take the money? Write your answer down. We’ll check it together when we run the demo.
Follow the session in order.
Read the setup, run the attack yourself, then see why it worked and how to fix it.
2. The interactive demo
Runs in your browser Build Mallory’s withdraw transaction yourself, switch between the vulnerable and fixed program, and watch each check run. Open the demo
3. After the demo
PDF, 4 slides Two constraints close the hole. Then Solana compared with Ethereum, a checklist for any program, and two questions to discuss. Open the slides (light)What you will learn.
A tip vault, a promise, and one missing check. The lesson uses about 90 lines of Rust written with Anchor.
The account model
Programs hold code and accounts hold everything else. The caller, not the program, chooses which accounts to pass in.
Think like an attacker
Every check that ran was correct. The bug is the check that never ran, and it compiles cleanly.
Fix it, then read any program
Two constraints close the hole. Take away an eight-question checklist for reading any Solana program.