Solana Program Security Checklist: Key Vulnerabilities Every Developer Must Audit

A developer has published a practical security checklist for Solana programs built with the Anchor framework, drawing on two weeks of adversarial testing and fuzzing. The guide is motivated by the February 2022 Wormhole bridge exploit, in which a single unverified account function led to a $326 million loss. The checklist covers critical failure modes unique to Solana's runtime, including account owner verification, PDA address re-derivation, discriminator checks, and the dangers of using unvalidated remaining_accounts. It highlights what Anchor handles automatically versus what developers must enforce themselves, such as CPI target identity and business logic validation. The author positions the checklist as a mandatory self-review step before any professional security audit is requested.