poc: decode Drift protocol hack transaction

[prasanna-anchorage]

Summary

Stacks Squads Multisig (#240) + Drift (#239) presets to fully decode the April 1 2026 Drift Protocol exploit transaction.

Depends on:

• feat(solana): add Squads v4 Multisig visualizer preset #240 — Squads v4 Multisig visualizer (with data_len u16 LE fix)
• feat(solana): add Drift Protocol visualizer preset #239 — Drift Protocol visualizer preset

What the parser reveals

The $285M Drift exploit used two pre-signed durable nonce transactions. The parser fully decodes both:

Transaction 1 — Create + Approve (signer 1)
https://solscan.io/tx/2HvMSgDEfKhNryYZKhjowrBY55rUx5MWtcWkG9hqxZCFBaTiahPwfynP1dxBSRk9s5UTVc8LFeS4Btvkm9pc2C4H

1. AdvanceNonceAccount          — activates durable nonce
2. vaultTransactionCreate       — Squads multisig wrapping inner Drift: updateAdmin
   └─ Inner: Drift updateAdmin  — Current admin: AiLGd...  →  New admin: H7PiG...
3. proposalCreate               — creates governance proposal (transactionIndex: 7)
4. proposalApprove              — first signer approves

Transaction 2 — Approve + Execute (signer 2)
https://solscan.io/tx/4BKBmAJn6TdsENij7CsVbyMVLJU1tX27nfrMM1zgKv1bs2KJy6Am2NqdA3nJm4g9C6eC64UAf5sNs974ygB9RsN1

1. AdvanceNonceAccount          — activates durable nonce
2. proposalApprove              — second signer approves (reaches 2-of-5 threshold)
3. vaultTransactionExecute      — executes the stored vault transaction

Defense point

The critical signing moment is Transaction 1. The parser decodes the nested vaultTransactionCreate and reveals Drift: updateAdmin with the new admin address — a signer reviewing this in a wallet would see the admin transfer before approving.

By Transaction 2, the inner instructions are already stored on-chain (not in the tx bytes), so vaultTransactionExecute only shows a reference to the vault transaction account. The defense must happen at Tx 1.

Key fixes discovered during this POC

• VaultTransactionMessage::deserialize was reading instruction data_len as u8 instead of u16 LE, causing a 1-byte offset that made inner instruction discriminators unmatchable
• Disambiguated "Current admin" vs "New admin" labels when IDL account and arg names collide

Test plan

• All workspace tests pass
• parser_cli correctly decodes both exploit transactions
• Inner updateAdmin shows current and new admin addresses

🤖 Generated with Claude Code