Solana Smart Contract Audit: Cost, Timeline and Checks

Video transcript

Solana programs hold no state. Every account is passed in, so an audit first asks whether each one is what the code thinks it is.

Four facts shape the review. Programs are stateless, owners gate writes, privileges travel through cross-program calls, and the upgrade authority can replace the code.

Anchor checks ownership, not that a stake record belongs to this user or a vault to this pool. In Guardian's Degen Safe report, missing checks caused three Criticals.

A CPI hands over your privileges, so reviewers trace forwarded accounts, PDA signer reach, upgradeable targets, Token twenty twenty-two extensions and front-runnable initialization.

Firms quote privately. A Lido forum post records Chorus One paying Neodyme ninety thousand dollars in 2021 to audit Lido on Solana.

Sherlock, which sells audits, estimates a 25 to 40 percent premium over Solidity. Guardian does not publish prices. Each audit is scoped from your repository and commit.

Three of Guardian's Solana reports show main reviews of four to eight days. The first of nine Jupiter engagements had no Criticals, Highs or Mediums, and a top confidence ranking of five.

Every Guardian audit runs two competing teams, one manual and one driving frontier AI, over invariant fuzzing. Vanguard adds a Guardian-funded contest and six months of update review.

Read the full article for the prep checklist, or talk to Guardian at guardian.security.

Solana programs fail differently from EVM contracts. A program holds no state of its own; every account it touches is passed in with the instruction.

So the first question in a Solana audit is not what the code does. It is whether each account is the one the code thinks it is.

This guide covers what reviewers check, what public records say about cost, and what Guardian's own Solana reports show about timeline.

Why Solana Audits Differ

Four facts from Solana's docs shape the review:

• Programs are stateless. All mutable state lives in data accounts passed with each instruction.
• Owners gate writes. Only an account's owner program can change its data or debit its lamports.
• Privileges travel. In a cross-program invocation (CPI), signer and writable privileges extend from caller to callee.
• Code can change. The upgrade authority can replace a program's code; revoking it makes the program immutable.

Anchor turns many checks into account types and constraints. The bugs move to the constraints nobody declared.

Account Validation

Anchor's Account type “checks ownership on deserialization”. It does not check that a stake record belongs to this user, or a vault to this pool.

That is the job of constraints such as has_one, seeds and constraint. Guardian's public reports show what happens when one is missing:

Anchor's own reference warns that with init_if_needed, “you need to make sure you properly protect yourself against re-initialization attacks.”

All five Degen Safe Criticals were resolved. Guardian still gave that report a confidence ranking of 1 and recommended a follow-up review at a frozen commit.

A March 2026 updates review found no Highs or Criticals and ranked 5.

CPI and PDA Risks

A CPI hands your accounts and privileges to another program. Solana's docs set these rules:

1. Writable privilege cannot escalate.
2. Signer privilege passes only from a caller's signer, or a caller's PDA via invoke_signed.
3. Indirect reentrancy (A calls B calls A) is rejected; direct self-recursion is allowed.

Those rules stop escalation. They do not stop you handing real authority to the wrong program.

At each CPI, reviewers trace:

• The accounts. Every account forwarded, including caller-supplied remaining_accounts.
• PDA signer reach. A target program could pass OneSig's PDA signer on to other programs (OneSig on Solana, I-06).
• Upgradeable targets. A signed OneSig call commits to a program ID, not that program's code (I-11).
• Token extensions. A Token-2022 permanent delegate could drain an escrow vault directly (Stampt L-04).
• Initialization. A public initialize can be front-run after deployment (Solana OApp, R1-I-16).

Cost and Timeline

Public price points for Solana audits are few. Chorus One paid for the Lido on Solana audits, then asked Lido to reimburse them.

Sherlock sells audits. It attributes the premium to scarcity: “the pool of qualified reviewers is substantially smaller”. It also estimates urgency adds 20 to 40 percent.

Guardian does not publish prices. Each audit is scoped from your repository and commit. For more public records, see what top auditors charge.

For timeline, three of Guardian's public Solana reports give the main review window:

Fix reviews come after, sometimes weeks later. Stampt's escrow had a three-day review in February 2026, then a two-day fix review in March.

Jupiter's largest scope, the 5,694-line Yield Store, was reviewed by two competing teams plus a fuzzing engineer.

Prep Checklist

1. Freeze a commit, and share the repository, program IDs and target cluster.
2. List every instruction, its signers and who may call it.
3. For each account, name the constraint that ties it to its user, pool or vault.
4. Avoid init_if_needed, or guard every field it could overwrite.
5. Put the pool or user key in the seeds of every PDA that must stay isolated.
6. List every CPI target, and pin each program ID.
7. State which token programs and Token-2022 extensions you accept.
8. Bind initialize to the upgrade authority, so nobody can front-run it.
9. Name who holds the upgrade authority, and whether it is a multisig.
10. Ship tests for accounting, such as vault balances against recorded deposits.

Our audit prep guide covers the rest.

Case Study: Jupiter

Guardian has run nine engagements for Jupiter since November 2025, all on Solana: JupUSD, the Offerbook lending market and the Yield Store vaults.

The first was the JupUSD stablecoin program: 2,101 source lines, four auditors, November 17 to 24, 2025.

It returned nine Lows and nine Informational findings, with no Criticals, Highs or Mediums, and Guardian's top confidence ranking of 5.

Three of the Lows:

• A Switchboard price call passed a Unix timestamp where the library expected a slot (L-01).
• Switchboard read the staleness limit as slots, while the vault meant seconds (L-07).
• A peg price action lacked its dedicated PegManager role check (L-04).

Later reviews followed the code as it shipped. The February 2026 updates review returned eleven Informational findings and a second 5 out of 5.

Jupiter names Guardian in its JupUSD documentation. The Jupiter client story covers every engagement.

How Guardian Audits Solana

Every smart contract audit runs the Guardian Standard: two competing teams on one scope, one manual and one driving frontier AI, over an invariant fuzzing suite.

A Vanguard audit adds a $100,000 Guardian-funded contest and six months of update review, up to 2,500 onchain SLOC.

Frequently Asked Questions

How much does a Solana smart contract audit cost?

Firms quote privately. A Lido forum post records Chorus One paying Neodyme $90,000 in December 2021 to audit Lido on Solana. Sherlock, which sells audits, estimates a 25 to 40 percent premium for Rust-based Solana programs over Solidity equivalents.

How long does a Solana audit take?

In three of Guardian's public Solana reports, main reviews ran four to eight calendar days, including Jupiter's 2,101-line JupUSD program. Fix reviews follow. Jupiter's largest scope, the 5,694-line Yield Store, had two competing teams plus a fuzzing engineer.

What does a Solana audit check that an EVM audit does not?

Mostly account validation: that every account passed in is the expected user's, pool's or vault's. It also covers PDA seeds, re-initialization, CPI targets and privileges, Token-2022 extensions and who holds the upgrade authority.

Does Anchor make a Solana program safe?

Anchor checks what you declare: account owners, signers, seeds and relationships. Missing user and pool checks, a PDA seed without the pool key, and an unguarded init_if_needed produced three Criticals in Guardian's public Degen Safe report.

Sources

• Solana Docs: Programs
• Solana Docs: Accounts
• Solana Docs: Cross Program Invocation
• Solana Docs: CPI Execution and Privileges
• Solana Docs: Program Deployment
• Anchor Docs: Account Types
• Anchor Docs: Account Constraints
• anchor-lang API reference: derive Accounts (init_if_needed)
• Lido Research Forum: Compensating security assessment costs for Lido-on-X projects, post 16 (April 20, 2022)
• Sherlock: Smart Contract Audit Pricing, A Market Reference for 2026 (February 2026)
• Arbitrum Forum: Arbitrum Audit Program proposal (February 6, 2025)
• Guardian: Degen Safe Protocol Review report (February 2, 2026)
• Guardian: Degen Safe Contract Updates report (March 18, 2026)
• Guardian: Jupiter JupUSD Stablecoin report (December 25, 2025)
• Guardian: Jupiter JupUSD Updates report (March 16, 2026)
• Guardian: Stampt Escrow report (April 1, 2026)
• Guardian: LayerZero Solana OApp report (July 20, 2026)
• Guardian: LayerZero OneSig on Solana report (August 16, 2026)
• Guardian: Jupiter client story
• Guardian: Vanguard
• Guardian: What Top Auditors Charge