sealevel-attacks-solana
Sealevel Attacks — Solana exploit patterns (reference)
Reference skill. This bundle does not vendor the repo; clone and build from upstream.
- Repository: github.com/coral-xyz/sealevel-attacks
- Maintainer context: Published under the Coral org (Anchor ecosystem).
- Stack: Anchor / Rust programs under
programs/, tests, migrations—see README.
What it is
Upstream describes examples of common exploits that arise from the Solana programming model (account model, CPIs, sysvars, etc.), plus idioms to avoid them using Anchor. Each example is intentionally incomplete: one isolated issue and fix per program—not a production template.
Use it to recognize vulnerability classes when reading DeFi code or post-mortems, not as a copy-paste base for new protocols.
How to combine with blockint
| Task | Skill |
|---|---|
| Solana DeFi review posture, Anchor/PDAs/CPIs | solana-defi-vulnerability-analyst-agent |
| Incident narratives, tx reconstruction | solana-tracing-specialist, flash-loan-exploit-investigator-agent |
| Broader DeFi / rug triage | defi-security-audit-agent |
| Surfpool / local testing stacks | solana-onchain-intelligence-resources (Helius docs index) |
Guardrails
- Authorized use only — study and defensive coding in devnet/local environments; no guidance for exploiting third-party mainnet programs.
- Legal — unauthorized access or theft of funds is criminal in most jurisdictions; this skill is education and audit support only.
- Completeness — patterns evolve with runtime and program versions; treat the repo as illustrative, not an exhaustive checklist.
- Disclosure — if you find a bug in a live project, follow responsible disclosure and the project’s policy.
Goal: a discoverable pointer to sealevel-attacks for Solana security learning and audits inside blockint.
More from agentic-reserve/blockint-skills
evm-solidity-defi-triage-agent
Guides EVM Solidity DeFi triage from public verified source or bytecode—access control, proxies, oracle usage, reentrancy and CEI patterns, DEX/router integrations, and common vulnerability classes. Use when the user asks for Ethereum or L2 smart contract security review, Solidity audit triage, OpenZeppelin proxy risks, or EVM-specific DeFi patterns—not for live exploits or private keys.
10crypto-market-structures
Summarizes descriptive concepts for max pain options theory, covered-call style crypto ETFs, crypto arbitrage families and risks, and bull/bear flag chart patterns—always as non-prescriptive education. Use when the user asks about max pain, premium income ETFs, arbitrage, funding rates, flash loans, or bull/bear flags in crypto trading context.
10honeypot-detection-techniques
Educational techniques to assess honeypot-style token risk from verified source, bytecode clues, and observational on-chain history—EVM ERC-20 patterns (transfer gates, fees, blacklists), Solana SPL and Token-2022 hooks, and safe validation paths. Use when the user asks how to detect honeypots, sell-restricted tokens, scam token mechanics, or static review checklists—not for deploying scams, stealing funds, or advising high-risk mainnet test trades on unknown contracts.
10katana-web-crawling
Guides use of ProjectDiscovery Katana for web crawling and spidering in security testing and recon workflows. Covers installation, standard vs headless mode, scope and rate limits, JSONL output, and piping from httpx or URL lists. Use when the user mentions Katana, projectdiscovery/katana, web crawling, spidering, endpoint discovery, attack surface mapping, or chaining crawlers in automation pipelines.
10solana-defi-vulnerability-analyst-agent
Guides discovery and documentation of Solana DeFi protocol risks from public code and chain state—Anchor/native programs, PDAs, CPIs, oracles, pools, SPL mechanics, and historical tx reconstruction. Use when the user asks for Solana program security review, DeFi vulnerability triage, PDA or CPI safety, oracle or liquidity-pool risk, launchpad/bonding-curve issues, or evidence-backed severity findings without exploits or private keys.
10solana-tracing-specialist
Guides Solana-specific on-chain forensics—ATA resolution, SPL instruction parsing, transaction history via RPC and indexers (e.g. Helius-style APIs), fund-flow graphs, Solana clustering heuristics, and program authority review. Use when the user investigates Solana wallets, SPL tokens, DEX/Jito flows, rug or phishing patterns on Solana, or needs evidence-structured tracing reports with public data only.
10