Solana and Rust smart contract audit
Solana programs trust every account they are handed. Guardian audits native Rust and Anchor programs for the account, PDA and CPI bugs that drain them.
Solana audits for
Jupiter
Onchain · Solana Audit
Every account checked, every CPI traced.
- Account validation Owner, signer and discriminator checks, and whether a stake record belongs to this user or a vault to this pool.
- PDAs Seeds, canonical bumps, collisions between pools, and what each PDA can sign for.
- CPIs Target program checks, forwarded accounts and signer privileges, and upgradeable targets.
- Token programs SPL Token and Token-2022 extensions, transfer hooks and fees, and mint and freeze authority.
- Arithmetic Checked math, u64 and u128 precision, rounding direction and casts.
- Lifecycle and authority Front-runnable initialization, init_if_needed, account closing and revival, and upgrade authority.
Covers native Rust and Anchor programs, SPL Token and Token-2022, and Rust on Stellar's Soroban. Every account an instruction accepts is checked against what the code assumes it is.
Published work
Solana programs Guardian has reviewed.
- Client storyJupiterNine engagements: JupUSD, Offerbook lending and the Yield Store vaults.
- ReportJupUSD2,101 source lines, four auditors and a 5 of 5 confidence ranking.
- ReportDegen SafeFive Criticals, from a vault PDA collision to an authority takeover. All resolved.
- ReportsLayerZero on SolanaThe Solana OApp, the Solana console and OneSig on Solana.
- ReportOrderly Solana stakingOrderly's staking program on Solana.
- GuideSolana program securityAnchor best practices: account checks, PDA bumps, CPI targets and closing.
Recent incidents
The failures a Solana audit tests for.
-
$326MWormhole
The program did not correctly verify an account it was given, so a forged signature set minted 120,000 whETH.
-
$285MDrift
With no timelock on admin changes, two of five council signers' pre-signed durable nonce transactions handed over control.
Apr 2026 Our breakdown of the Drift incident
-
$115MMango Markets
The MNGO price was pushed up and borrowed against, leaving $115M in bad debt.
“As a security audit company, Guardian’s approach to security and overall effectiveness is truly exceptional. Working with them has been a revelation – their auditors are among the best we’ve ever collaborated with.”
Slava GerashenkoOrderly Network“Guardian’s thorough audit process have left a strong impression on us. Their keen eye for detail and responsive support are qualities that shine through in every engagement.”
Core TeamLayerZeroQuestions
Solana audit questions
Do you audit native Rust as well as Anchor?
Yes. Anchor's constraints check owners and signers, not that a stake record belongs to this user or a vault to this pool, so both are reviewed account by account. Rust programs on Stellar's Soroban are covered too.
How long does a Solana audit take?
Three of Guardian's published Solana reports show main reviews of four to eight days. Solana audit cost and timelines has public reference points, and scope comes from your repository and commit.
Do Solana audits include a fuzzing suite?
They can. Jupiter's Lend referral program shipped with a dedicated fuzzing suite covering the full program, alongside the review.
Do you review upgrade authority and multisigs?
Upgrade, mint and freeze authorities are in scope on every Solana audit. Signer setup, durable nonces and transaction review are covered by an OpSec Audit or Managed Security.
How much does it cost, and how long does it take?
Guardian scopes every audit from your repository and commit, so there is no list price. The cost estimator gives a range from nSLOC, and how long an audit takes covers review windows, code freeze and fix review.
Smart Contract Audit
Other engagements
- Featured · Onchain Vanguard Audit A security audit designed to protect onchain teams facing unprecedented cyber risk. Explore Vanguard
- Managed services Managed Security Dedicated response team, red team, 24/7 attack and defense across every surface you run, onchain and off. Explore Managed Security
- OnchainSmart Contract AuditTwo competing teams, Helix AI and invariant fuzzing.
- OnchainStablecoin AuditMint limits, roles, freezes, oracles and multichain deployments.
- OnchainSolidity AuditAccess control, reentrancy, math, upgrades and assembly.
- OnchainDeFi Protocol AuditAccounting, oracles, liquidations and integrations.
- OffchainOpSec AuditKeys, signers, privileged roles, and critical operations.
- Penetration testingAll pentestsEvery offchain engagement, and how Guardian runs them.
Start now