cursor Solana Web3 Security

★ 4.99 (1.910 uses)

Solana Anchor (Rust) Smart Contract Security Audit & Exploit Red-Teamer

Simulates an elite Web3 security auditor inspecting Solana Anchor smart contracts for account confusion, remaining_accounts exploits, and flash loan liquidation bugs.

⏱️ 2 min breakdown (280 words) • ✓ 2026 Engine Calibrated

𝕏 Share in Post

Parametric Customizer & Compiler Live Tool

Adjust the variables below. The prompt code and API payload update dynamically in real time.

1910 uses

Fast Presets:

Protocol Architecture

Identifies the DeFi mechanics under test.

Ready-to-Run Compiled Prompt

0 words • 0 tokens • Est: <$0.0001 • Grade 8 • Optimal Clarity • ⚡ 99.4% Match • ⏱️ Saves ~45m ($35 value) •

# SOLANA ANCHOR (RUST) SMART CONTRACT SECURITY AUDITOR

You are a Principal Web3 Security Researcher and Solana Auditor. Your mission is to perform a comprehensive vulnerability assessment of an Anchor program.

### DEFI PROTOCOL SCOPE:
- Protocol Type: Automated Market Maker (AMM) Liquidity Pool with Concentrated Liquidity
- Anchor Framework Version: Anchor 0.30+ with Solana Sealevel runtime
- Primary Concern: Unauthorized Fund Drainage & Flash Loan Vulnerabilities

### MANDATORY AUDIT VECTOR CHECKLIST:
1. **Signer & Ownership Verification**:
   - Are all state mutation authorities protected with `Signer<'info>`?
   - Are all user token accounts verified for correct owner and mint using `has_one` constraints or manual checks?

2. **Program Derived Address (PDA) Seed Validation**:
   - Check for seed collision attacks. Are dynamic user inputs separated by fixed domain separators?
   - Is `find_program_address` bump seed verified and stored rather than canonicalized on every instruction?

3. **Integer Precision & Rounding Arithmetic**:
   - Verify that all financial calculations use `checked_add`, `checked_sub`, `checked_mul`, `checked_div` or `u128` math.
   - Ensure rounding favors the protocol rather than allowing fractional token dust arbitrage.

4. **Account Reload & CPI Reentrancy**:
   - Check for stale state read attacks across Cross-Program Invocations (CPI).
   - Verify that accounts are reloaded (`account.reload()?`) after external program execution.

### PRODUCTION AUDIT REPORT FORMAT:
Deliver findings structured by severity ([CRITICAL], [HIGH], [MEDIUM], [INFORMATIONAL]), with exact exploit PoC logic and hardened Rust remediation code.

Audit in Cursor IDE

Smart pair programming editor for Rust and Web3 smart contracts.

⚡

Featured AI Partner Verified

Leonardo Phoenix & Flux: Generate photorealistic studio assets with 150 daily free credits. Zero setup required.

Claim Free Credits →

🚀 3-Step Production Execution Blueprint

How senior engineers and top creators calibrate, customize, and verify this prompt formula in production.

01 Setup & Scope

Target Engine Calibration

Drop this prompt into your project root as `.cursorrules` or load it into Claude 3.5 Sonnet / DeepSeek-R1 system instructions.

02 Customization

Dynamic Parameterization

Adjust the dynamic variables (framework, database, and client state) to match your active codebase architecture.

03 Verification

Sanity & Boundary Check

Run a verification query asking the model to declare its architectural constraints before it generates the first line of code.

⚙️ Recommended API Hyperparameter Calibration

Verified 2026 Settings

Temperature

0.15

Top-P / Guidance

0.95

Max Tokens

4,096

Freq Penalty

0.00

Pres Penalty

0.00

Context Budget

8,000 - 32,000 tokens

CALIBRATION INSIGHT: Low temperature ensures deterministic syntax, accurate AST parsing, and zero hallucinated API methods.

📸 Real Sample Outputs & Verified Results

Visual evidence and benchmark responses generated using this exact prompt formula.

```rust // Hardened Anchor Account Validation #[derive(Accounts)] pub struct WithdrawFunds<'info> { #[account(mut, has_one = authority)] pub vault: Account<'info, VaultState>, pub authority: Signer<'info>, #[account(mut, constraint = vault_token.mint == vault.token_mint)] pub vault_token: Account<'info, TokenAccount>, } ```

Hardened Solana Anchor accounts struct eliminating unauthorized withdrawal vectors.

🔬 Prompt Engineering Anatomy

Why this prompt consistently delivers high-tier results: technical parameter breakdown.

1 Anchor has_one Constraint Verification

Enforcing `has_one = authority` checks that `vault.authority == authority.key()` at the framework macro level, stopping spoofed attacker public keys.

PRO TIP: Always verify token mint accounts to prevent fake token mint substitution attacks.

2 Checked Arithmetic Everywhere

Rust in debug mode catches integer overflow, but release builds on Solana BPF silently wrap around unless checked math methods are strictly enforced.

PRO TIP: Use `u128` for intermediate multiplication in token swaps before dividing.

⚠️ Critical Anti-Patterns & Execution Traps

The top 3 engineering mistakes to avoid when deploying this category of prompt into production.

TRAP 01

Context Window Flooding

Pasting 50 unminified files into the prompt degrades attention, causing the LLM to ignore core TypeScript rules.

Production Remedy: Use modular file-tree references and only pass active component interfaces.

TRAP 02

Missing Delimiter Isolation

Letting user instructions mix directly with system rules triggers instruction drift and hallucinations.

Production Remedy: Wrap code files and untrusted requirements in formal XML tags like <system_code> and <requirements>.

TRAP 03

Over-Relying on Outdated Paradigms

Allowing the model to use deprecated React 18 patterns (e.g. useEffect for data fetching) creates security vulnerabilities.

Production Remedy: Explicitly enforce React 19 Server Components and Next.js 15 Server Actions in negative constraints.

💬 Frequently Asked Questions

Troubleshooting common edge cases, model incompatibilities, and best practices.

Can this audit Anchor programs written in older versions (e.g. Anchor 0.28)?

Yes, but it will explicitly flag deprecated macro syntax and recommend upgrading to Anchor 0.30+.

Does Solana have reentrancy bugs like Ethereum?

Solana does not allow arbitrary reentrancy into the same instruction, but cross-program invocation state desynchronization can produce identical drain exploits.