current workflow:
fork mainnet
run security scan
fuzz weird execution paths
export report
before deployment ever touches production.
fork mainnet
run security scan
fuzz weird execution paths
export report
before deployment ever touches production.
0
0
0
9
we built SolanaTestForge during @colosseum Frontier Hackathon because “tests passed” means very little without adversarial conditions.
fork state.
mutate inputs.
break assumptions first.
github.com/EconomicFuzz-d…
fork state.
mutate inputs.
break assumptions first.
github.com/EconomicFuzz-d…
0
0
0
17
forking mainnet does not just make tests more realistic.
it removes assumptions.
same program.
same instructions.
completely different outcomes once real state is involved.
demo: economicfuzz.vercel.app
it removes assumptions.
same program.
same instructions.
completely different outcomes once real state is involved.
demo: economicfuzz.vercel.app
0
0
0
7
some teams treat testing like confirmation.
we treat it like adversarial research.
if the protocol survives weird timing, weird state, and weird inputs,
then the real confidence starts.
we treat it like adversarial research.
if the protocol survives weird timing, weird state, and weird inputs,
then the real confidence starts.
0
0
0
5
current workflow inside SolanaTestForge:
fork state
run scanner
fuzz instructions
export report
all before deployment touches mainnet.
fork state
run scanner
fuzz instructions
export report
all before deployment touches mainnet.
0
0
1
26
local validator:
everything green.
forked mainnet:
slot mismatch,
oracle drift,
unexpected CPI path.
same program.
different reality.
everything green.
forked mainnet:
slot mismatch,
oracle drift,
unexpected CPI path.
same program.
different reality.
0
0
1
12
most teams test happy paths. some test failure paths. almost nobody tests timing.
oracle lag. slot delay. account sync. that is where things break.
oracle lag. slot delay. account sync. that is where things break.
0
0
2
7
instruction passed all checks.
post-state matched expectations.
except one thing:
rent-exempt threshold dropped below minimum after transfer.
not caught in test.
caught in fork.
yes, that is a bug.
post-state matched expectations.
except one thing:
rent-exempt threshold dropped below minimum after transfer.
not caught in test.
caught in fork.
yes, that is a bug.
0
0
2
7
coming from Foundry? fuzzing on solana is not just calldata mutation.
you are mutating:
- account state
- signer flags
- cpi boundaries
same idea. different failure modes.
you are mutating:
- account state
- signer flags
- cpi boundaries
same idea. different failure modes.
0
0
1
17
forking mainnet does not just give you real state. it removes assumptions.
most programs pass on local validator.
fail within 20s on fork. that is the gap people underestimate.
most programs pass on local validator.
fail within 20s on fork. that is the gap people underestimate.
0
0
1
8
found this after ~420k iterations.
cpi call succeeded.
state updated.
event emitted.
authority check failed silently. yes, that is a bug.
cpi call succeeded.
state updated.
event emitted.
authority check failed silently. yes, that is a bug.
0
0
1
10
Testing Solana CPIs is hard: inner instructions are hidden from logs by default, transaction-level pre/post checks miss intermediate state bugs, and target programs often only exist on mainnet. Forking solves the mainnet issue, but the first two are on you.
0
0
2
18
coming from Foundry? here is the rough mapping.
forge test → solforge test vm.deal() → forked account state with whatever lamports you want vm.prank() → no direct equivalent.
CPI authority is checked at instruction boundary, not impersonated at runtime.
forge test → solforge test vm.deal() → forked account state with whatever lamports you want vm.prank() → no direct equivalent.
CPI authority is checked at instruction boundary, not impersonated at runtime.
0
0
2
21
ran security check on a hackathon program last week. signer_check failed on withdraw. authority account had no isSigner flag.
2 critical, 1 high, 0 minutes to find. the report was longer than the program. yes, that is a bug. fixed before submission.
2 critical, 1 high, 0 minutes to find. the report was longer than the program. yes, that is a bug. fixed before submission.
0
0
4
37
submitting solanatestforge to @colosseum.
`forge test --fork mainnet --fuzz 800000`
~30 seconds.
2 critical bugs.
1 unexpected revert path.
demo will be live.
`forge test --fork mainnet --fuzz 800000`
~30 seconds.
2 critical bugs.
1 unexpected revert path.
demo will be live.
1
0
4
54
found this edge case after 600k iterations. instruction succeeded. state updated. lamports not synced for one slot.
yes, that is a bug. fix shipped in v0.5.3.
yes, that is a bug. fix shipped in v0.5.3.
16
0
14
234
testing against local validators is where most issues hide. forking mainnet state usually breaks assumptions in under 30s.
6
0
8
105
