Sigvex
SolanaAnalysis2 min read

Solana PDA Forensics

The forensics results for a Solana program-derived account — its owning program and discriminator, plus timeline, findings, dust, fund flow, counterparties, and matched attacks.

Open Solana PDA AnalysisAll guides
svmsolanapdaforensics

Solana PDA Forensics investigates a program-derived account — the state a program owns rather than an account a user controls. A completed run lands here with the PDA’s owning program and discriminator up front, then the same forensics tabs you’d use on a wallet, scoped to what makes sense for a data account.

Why it exists

A PDA holds program state but isn’t executable, so the full wallet tab set — approvals, post-mortem, compliance, evidence — doesn’t apply. What does matter is what program owns it and how value and activity flowed through it. This page keeps the shared forensics layout, surfaces the PDA-specific metadata, and drops the tabs that don’t fit.

Who uses it

  • Forensics analyst — investigates a specific PDA tied to an exploit or anomaly.
  • Auditor — reviews PDA activity connected to an audited program.

What’s on the page

A quick-insights panel shows the owning program, the discriminator, and the risk score. From there the tabs are Timeline, Findings, Dust, Fund Flow, Counterparties, and Attacks — the account’s events, detector hits, dust indicators, value flow, interaction partners, and matched attack patterns.

How to open it

  1. From a Solana PDA forensics run after it completes.
  2. From an asset card for a Solana PDA.
  3. Direct URL — /solana-pda?network=<chain>&address=<base58>.

Limits

  • Requires a signed-in account.
  • The wallet-only tabs aren’t shown for PDAs, and some tabs load a moment after the first render.
  • Not every PDA resolves to a known owning program — an empty owning-program field is a valid result.