Defying the Odds: Solana's Unexpected Resilience in Spite of the Security Challenges Faced by Developers
S\'ebastien Andreina, Tobias Cloosters, Lucas Davi, Jens-Rene Giesen,, Marco Gutfleisch, Ghassan Karame, Alena Naiakshina, and Houda Naji

TL;DR
This study investigates Solana's smart contract security, revealing developers' challenges, vulnerability detection gaps, and the ecosystem's surprising resilience due to frameworks like Anchor, despite prevalent security concerns.
Contribution
First comprehensive analysis of Solana smart contract security challenges, developer practices, and ecosystem resilience, highlighting the role of frameworks like Anchor in enhancing security.
Findings
Developers often miss critical vulnerabilities during code reviews.
Majority of developers are likely to release vulnerable contracts.
Automated analysis shows low vulnerability prevalence in deployed contracts.
Abstract
Solana gained considerable attention as one of the most popular blockchain platforms for deploying decentralized applications. Compared to Ethereum, however, we observe a lack of research on how Solana smart contract developers handle security, what challenges they encounter, and how this affects the overall security of the ecosystem. To address this, we conducted the first comprehensive study on the Solana platform consisting of a 90-minute Solana smart contract code review task with 35 participants followed by interviews with a subset of seven participants. Our study shows, quite alarmingly, that none of the participants could detect all important security vulnerabilities in a code review task and that 83% of the participants are likely to release vulnerable smart contracts. Our study also sheds light on the root causes of developers' challenges with Solana smart contract development,…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsInformation and Cyber Security
