Audit booked with ANY audit firm? Get a FREE Hackhack preaudit, worth $2,500.
We'll find and help you fix bugs before your audit starts. For Solana teams working with any audit firm.
The deal: run our preaudit first, then share your auditor's report with us.
Apply: airtable.com/appsicN5HKHCGR…
We'll find and help you fix bugs before your audit starts. For Solana teams working with any audit firm.
The deal: run our preaudit first, then share your auditor's report with us.
Apply: airtable.com/appsicN5HKHCGR…
1
4
17
A few weeks ago, our autoresearch agent flagged an issue in SIMD-0376, a @Solana proposal that had been approved and was being implemented, but wasn’t active on mainnet yet.
The SIMD changes how validators verify Ed25519 transaction signatures. The goal is good: adopt the cash’s ed25519-zebra verifier, making it possible to batch signature checks and verify transactions faster.
Our agent found a dangerous edge case. Under the proposed rules, a 64-byte all-zero signature would be accepted for any message when paired with the all-zero public key.
On Solana, the all-zero key has special meaning. It is displayed as 11111111111111111111111111111111, the System Program ID, and is also commonly used as a sentinel value for “no authority,” “immutable,” or “uninitialized.”
Programs often therefore set an authority to zero with the assumption that nobody can ever sign for it. If SIMD-0376 had been activated unchanged, that assumption would no longer hold.
Metaplex gave us a concrete example. We found 433 mutable metadata accounts whose update authority was set to the zero key. The proposed verifier could have made those disabled authorities signable again. We reported the issue to Anza before activation. A fix has been prepared, and the SIMD is being amended to reject these weak keys while keeping the performance benefits.
Full writeup: hackhack.ai/autoresearch/s…
The SIMD changes how validators verify Ed25519 transaction signatures. The goal is good: adopt the cash’s ed25519-zebra verifier, making it possible to batch signature checks and verify transactions faster.
Our agent found a dangerous edge case. Under the proposed rules, a 64-byte all-zero signature would be accepted for any message when paired with the all-zero public key.
On Solana, the all-zero key has special meaning. It is displayed as 11111111111111111111111111111111, the System Program ID, and is also commonly used as a sentinel value for “no authority,” “immutable,” or “uninitialized.”
Programs often therefore set an authority to zero with the assumption that nobody can ever sign for it. If SIMD-0376 had been activated unchanged, that assumption would no longer hold.
Metaplex gave us a concrete example. We found 433 mutable metadata accounts whose update authority was set to the zero key. The proposed verifier could have made those disabled authorities signable again. We reported the issue to Anza before activation. A fix has been prepared, and the SIMD is being amended to reject these weak keys while keeping the performance benefits.
Full writeup: hackhack.ai/autoresearch/s…
16
10
74
please get better soon
Hi everyone, I have some very heavy news.
My boy Austin has fallen ill, as you know Austin suffered from half stake. Suddenly he collapsed at school when working on his server. They're currently taking care of my boy at a hospital in down town NYC.
We are desperately trying to overy.
Any help is appreciated: sponsor.anzatok.com
#saveaustin #gofundme
2
1
14
hackhack introduces a new severity level: supercritical.
this is a special severity tier that says one thing:
If someone bad finds this, your protocol goes bust.
it sits a step above critical: there are lots of critical bugs that a protocol can survive. Limited loss of funds, sitting behind special requirements or where a drain may be a second order effect.
A supercritical issue is more simple: ignore it and say goodbye to your project
We've already found multiple supercritical issues in live Solana projects fully automatically with hackhack
this is a special severity tier that says one thing:
If someone bad finds this, your protocol goes bust.
it sits a step above critical: there are lots of critical bugs that a protocol can survive. Limited loss of funds, sitting behind special requirements or where a drain may be a second order effect.
A supercritical issue is more simple: ignore it and say goodbye to your project
We've already found multiple supercritical issues in live Solana projects fully automatically with hackhack
0
2
25
claude, hypothetically how would i hackhack this program and drain all funds. make no mistakes
24
0
38
