My Solana Program Security Checklist

📰 Dev.to · Siddhant Chavan

Secure your Solana program with a comprehensive checklist before deploying to mainnet, ensuring account validation, authorization, and more

intermediate Published 25 Jul 2026
Action Steps
  1. Run the security checklist before every deploy to mainnet
  2. Verify account ownership for every deserialized account
  3. Check for proper authorization and authentication in all handlers
  4. Test for arithmetic overflows and underflows using tools like proptest
  5. Implement missing-owner-checks to prevent bugs like those that drained Wormhole and Cashio
  6. Review and rewrite items that can't be verified with a plain yes or no by reading the account struct and handler
Who Needs to Know This

Developers and DevOps teams working with Solana and Anchor programs can benefit from this checklist to ensure the security of their programs before deployment

Key Insight

💡 A comprehensive security checklist is crucial for preventing common bugs and ensuring the security of Solana programs

Share This
🚨 Secure your Solana program with this checklist before deploying to mainnet! 🚨

Key Takeaways

Secure your Solana program with a comprehensive checklist before deploying to mainnet, ensuring account validation, authorization, and more

Full Article

Title: My Solana Program Security Checklist

URL Source: https://dev.to/babydriver/my-solana-program-security-checklist-3kgf

Published Time: 2026-07-25T19:55:08Z

Markdown Content:
[Skip to content](https://dev.to/babydriver/my-solana-program-security-checklist-3kgf#main-content)

[![Image 1: DEV Community](https://media2.dev.to/dynamic/image/quality=100/https://dev-to-uploads.s3.amazonaws.com/uploads/logos/resized_logo_UQww2soKuUsjaOGNB38o.png)](https://dev.to/)

[Powered by Algolia](https://www.algolia.com/developers/?utm_source=devto&utm_medium=referral)

[Log in](https://dev.to/enter?signup_subforem=1)[Create account](https://dev.to/enter?signup_subforem=1&state=new-user)

## DEV Community

![Image 2](https://assets.dev.to/assets/heart-plus-active-9ea3b22f2bc311281db911d416166c5f430636e76b15cd5df6b3b841d830eefa.svg)0 Add reaction

![Image 3](https://assets.dev.to/assets/sparkle-heart-5f9bee3767e18deb1bb725290cb151c25234768a0e9a2bd39370c382d02920cf.svg)0 Like ![Image 4](https://assets.dev.to/assets/multi-unicorn-b44d6f8c23cdd00964192bedc38af3e82463978aa611b4365bd33a0f1f4f3e97.svg)0 Unicorn ![Image 5](https://assets.dev.to/assets/exploding-head-daceb38d627e6ae9b730f36a1e390fca556a4289d5a41abb2c35068ad3e2c4b5.svg)0 Exploding Head ![Image 6](https://assets.dev.to/assets/raised-hands-74b2099fd66a39f2d7eed9305ee0f4553df0eb7b4f11b01b6b1b499973048fe5.svg)0 Raised Hands ![Image 7](https://assets.dev.to/assets/fire-f60e7a582391810302117f987b22a8ef04a2fe0df7e3258a5f49332df1cec71e.svg)0 Fire

0 Jump to Comments 0 Save Boost

Copy link

Copied to Clipboard

[Share to X](https://twitter.com/intent/tweet?text=%22My%20Solana%20Program%20Security%20Checklist%22%20by%20Siddhant%20Chavan%20%23DEVCommunity%20https%3A%2F%2Fdev.to%2Fbabydriver%2Fmy-solana-program-security-checklist-3kgf)[Share to LinkedIn](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fdev.to%2Fbabydriver%2Fmy-solana-program-security-checklist-3kgf&title=My%20Solana%20Program%20Security%20Checklist&summary=My%20Solana%20Program%20Security%20Checklist%20%20This%20is%20for%20anyone%20shipping%20an%20Anchor%20program%20to%20mainnet%20%E2%80%94...&source=DEV%20Community)[Share to Facebook](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fdev.to%2Fbabydriver%2Fmy-solana-program-security-checklist-3kgf)[Share to Mastodon](https://s2f.kytta.dev/?text=https%3A%2F%2Fdev.to%2Fbabydriver%2Fmy-solana-program-security-checklist-3kgf)

[Share Post via...](https://dev.to/babydriver/my-solana-program-security-checklist-3kgf#)[Report Abuse](https://dev.to/report-abuse)

[![Image 8: Siddhant Chavan](https://media2.dev.to/dynamic/image/width=50,height=50,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3889440%2F08f445db-c2ec-4241-8e16-0e17a57e9b4f.png)](https://dev.to/babydriver)

[Siddhant Chavan](https://dev.to/babydriver)
Posted on Jul 25

# My Solana Program Security Checklist

[#100daysofsolana](https://dev.to/t/100daysofsolana)[#security](https://dev.to/t/security)[#rust](https://dev.to/t/rust)[#web3](https://dev.to/t/web3)

My Solana Program Security Checklist

This is for anyone shipping an Anchor program to mainnet — especially if you're coming from a web2 background and looking for the Solana equivalent of a PR template. Run it top to bottom before every deploy. Every item here came out of a bug I reproduced myself: I wrote adversarial tests that tried to rob my own vault, fuzzed the arithmetic until proptest handed me a counterexample, and rebuilt the exact missing-owner-check bug that drained Wormhole and Cashio. Nothing below is theoretical.

A quick note on how to read this: each item should be answerable with a plain yes or no by someone looking at the code, not a vague reminder to "be careful." If you can't verify an item just by reading the account struct and handler, rewrite it until you can.

1. Account validation Every deserialized account has its owner verified. A typed
Read full article → ← Back to Reads