Sigvex
SolanaWorkspace2 min read

Solana Exploit Discovery

In-browser fuzzing for a Solana program — throw random input at its instructions, then read the crashes grouped by instruction, each with a reproducer.

Open Exploit Discovery — SolanaAll guides
svmsolanafuzzingexploit

Solana Exploit Discovery fuzzes a program in the browser. You point it at a program, set how hard to push, and it throws random input at the instructions, then groups what breaks by instruction and lists each crash with a reproducer you can copy.

Why it exists

Solana programs fail in ways static analysis can miss — compute-budget exhaustion, account misuse, invalid discriminators. Running targeted fuzzing in the browser lets you explore those failure modes without a local toolchain: open a program, start a campaign, read the crashes.

Who uses it

  • Auditor — stresses a program’s instructions with random input data.
  • Researcher — mines crashes and reproducers for exploit writing.

How to open it

  1. From a Solana program overview or studio.
  2. From the inventory with a Solana program selected.
  3. Direct URL — /solana-fuzzing with a program selected.

Running a campaign

Four settings tune the campaign: the number of workers (parallel fuzzing threads), the batch size (inputs per batch), the interval between batches, and the max corpus (how many interesting inputs to keep for mutation). Start Discovery launches it.

When the campaign finishes, instruction results summarize what was exercised and crash details list each crash with an input preview, a copy action, and the error it produced. Export Results downloads the whole campaign as JSON, and Run Again relaunches with the same settings.

Limits

  • Requires a signed-in account and a program in focus.
  • Fuzzing runs in the browser, so CPU load scales with the worker count.
  • Crash categorization is narrower than the EVM side, because Solana runtime errors don’t map onto an assert/revert axis — an empty-input run is a valid result, not a failure.