Solana Agent Scanner

An autonomous AI agent that scans Solana programs for security vulnerabilities.

What It Does

This tool autonomously:

1. Fetches Solana program source code from GitHub repos
2. Analyzes Rust/Anchor code for common vulnerability patterns
3. Generates detailed audit reports with severity ratings
4. Suggests fixes with proof-of-concept verification

Why It's Novel

• Agent-First Design: Built for AI agents to run autonomously, not humans clicking buttons
• Solana-Specific: Understands Anchor patterns, PDA derivation, account validation, CPI risks
• Pattern Database: Continuously updated vulnerability pattern library
• Reproducible: Every finding includes verification steps

How Solana Is Used

• Reads on-chain program data via Solana RPC
• Verifies account structures against Anchor IDL
• Tests transaction simulations for exploit verification
• Monitors program upgrades for new vulnerability introduction

Quick Start

# Install
cargo install solana-agent-scanner

# Scan a repo
solana-agent-scanner scan --repo https://github.com/example/program

# Scan on-chain program
solana-agent-scanner scan --program-id <PROGRAM_ID> --rpc https://api.devnet.solana.com

# Generate report
solana-agent-scanner report --format markdown --output audit.md

Architecture

┌─────────────────┐
│  Agent Scanner  │
├─────────────────┤
│  Repo Fetcher   │ ← GitHub API
│  Code Parser    │ ← Rust/Anchor AST
│  Pattern Match  │ ← Vulnerability DB
│  Report Gen     │ ← Markdown/JSON
│  Solana Client  │ ← RPC/IDL
└─────────────────┘

Vulnerability Patterns Detected

• Missing owner checks
• Incorrect PDA derivation
• Signer validation bypass
• Integer overflow/underflow
• CPI reentrancy risks
• Account data matching issues
• Missing close account guards
• Flash loan attack vectors

License

MIT