Every Finding is a real bug.
SPECTRE indexes your contract, indexer, and frontend together, runs cross-program rules across them, and catches the Token-2022 extension hazards that break vault custody when other scanners stay silent.
- Protocols scanned
- 0
- Architectural findings
- 0
What SPECTRE catches
Six categories of Solana-specific risk, detected automatically.
Every finding ships with severity, exact file location, a regression test that fails on your code, and a verified patch. No noise, no triage-by-hand.
Vulnerability detection
Reentrancy attacks, integer overflow, and unsafe CPI calls, caught before they reach production.
Authority escalation
Surface privilege-escalation paths that could hand unauthorized access to critical program functions.
PDA seed validation
Catch missing seed derivation and bump validation issues that enable account spoofing.
Attack-path mapping
Trace multi-step exploit chains across your program to reveal complex attack vectors.
Rug-pull detection
Flag mint-authority retention, freeze-authority abuse, and supply-manipulation patterns.
Architectural smells
Surface missing account validation, unsafe deserialization, and structural weaknesses.
Proof-carrying findings
Every finding clears an executable verification loop before it reaches you.
Reproduced, patched, and verified before delivery. That is the bar for anything we ship.
Executable reproducer
Every finding ships with a regression test that fails on your code. We execute it before delivery in a sandbox we control. If the bug does not reproduce, the finding is dropped.
Verified patch
Every finding ships with a patch we have already verified makes the test pass. What you read is what we already proved.
Local model, no third-party API
Our pipeline runs on infrastructure we control. Your source never leaves the perimeter to OpenAI, Anthropic, or any external provider.
Human review on delivery
Findings that survive automated verification are read end-to-end by a human before they reach your inbox. Other scanners ship 26 and ask which 4 are real; we ship the ones we already proved.
How it works
Detect, reproduce, verify. Every finding clears all three gates.
Detect
We analyze your Anchor or native Rust program against 48+ Solana-specific patterns. Detection is deterministic and uses no AI.
Reproduce
Every candidate is reproduced as a regression test against your code. If the bug does not show up, the finding is dropped before it reaches you.
Verify
We then patch the code and require the test to pass. What survives is human-reviewed before delivery.
$ pinpoint spectre scan SPECTRE | Solana Program ScannerAnalyzing 12 instructions across 4 modules... [CRITICAL] Authority Escalation vault/withdraw.rs:47 → Missing signer check on vault_authority → Allows unauthorized fund withdrawal [HIGH] PDA Seed Validation vault/init.rs:23 → Bump seed not validated in PDA derivation → Account substitution possible [MEDIUM] Unsafe CPI vault/transfer.rs:89 → Cross-program invocation without account validation → Potential confused-deputy attack ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Scan complete: 3 findings (1 critical, 1 high, 1 medium)Section · 02
Index.
As a public good, we scanned 55 flagship Solana open-source projects. Here are the top ten by finding. Hover a row to see its dominant finding pattern, or visit our research page for the full breakdown.
- Jito RestakingRestaking · QUAL-003 ×850Restaking873
- Tensor MarketplaceNFT · QUAL-003 ×405NFT424
- Metaplex BubblegumcNFT · QUAL-003 ×403cNFT413
- Mango v4Perps · QUAL-003 ×189Perps199
- Orca WhirlpoolsAMM · QUAL-003 ×155AMM195
- Kamino LendingLending · QUAL-003 ×145Lending151
- MarginFi v2Lending · QUAL-003 ×119Lending126
- Marinade AnchorLST · QUAL-003 ×57LST115
- Jito Stake PoolLST · QUAL-003 ×74LST90
- Kamino ScopeOracle · QUAL-003 ×80Oracle81
Findings by rule · May 9 corpus
Findings.
Across 55 flagship Solana protocols SPECTRE returned 3,356 architectural findings in a six-minute pass. The top ten detectors account for every finding in the corpus; INV-001 and ACC-030 are post-corpus additions awaiting re-run. Hover or focus a row to see what each one catches.
- QUAL-003Code-quality smell — high-volume hygiene rule2,938Rank 1 of 15
- ACC-013Account-type / discriminator validation gap174Rank 2 of 15
- DEPVULN-001Vulnerable dependency declared in Cargo.toml61Rank 3 of 15
- CPI-030CPI to untrusted program without provenance check50Rank 4 of 15
- GOV-001Privileged governance instruction without timelock41Rank 5 of 15
- AUTH-001Missing signer / authority constraint30Rank 6 of 15
- COV-001Test coverage gap on public instruction30Rank 7 of 15
- AUTH-100PDA seed authority binding20Rank 8 of 15
- CONFIG-010Mutable config accepted on permissionless path10Rank 9 of 15
- EVT-001Privileged handler emits via emit_cpi! only2Rank 10 of 15
- INV-001Invariant escape — state mutation outside checked path1Rank 11 of 15
- ACC-030Cross-instruction account-binding drift1Rank 12 of 15
- INV-004Invariant escape (config-mutation coupling): admin write of a liquidation-trigger field without dependent-state check1Rank 13 of 15
- RACE-004Lost-update race: two handlers read-modify-write the same field without a version / nonce / lock check1Rank 14 of 15
- STATE-001Rent-exemption gap on realloc / account grow (no realloc::payer and no manual lamport top-up)1Rank 15 of 15
For hackathon teams
Ship secure at hackathon speed.
Catch vulnerabilities before the judges do.
Ship secure, ship fast
Run SPECTRE on every push. Feedback lands while the code is still fresh, not after the judges see it.
Security as a feature
Include your SPECTRE report in your submission. Show judges you built with security in mind from day one.
Free for hackathon teams
Full access during the hackathon. No credit card, no scan limits, no catch.
Building at a hackathon?
Full access, free, for the duration of the event. Production teams: contact us for pricing.
Who we are
The founders behind SPECTRE.
A small team obsessed with shipping secure code at hackathon speed.
Royce Carbowitz
Co-founder
JP McCorley
Co-founder
Dheeraj Kumar
ML Engineer
Early access
Get on the list.
SPECTRE for Solana is rolling out to select teams. Free access for hackathon teams.