Swaroop Maddu

🦀 Solana Dev ⚓️ | Rust 🦀 | Web 3 | Developer @osec_io 🦦
Prev Research Engineer @strawhatxyz

[OtterSec @osec_io]

Anchor is moving to a permanent home at otter-sec/anchor as we take over its stewardship.

Solana's ecosystem has been core to our work for years. Anchor has always been security-forward, and we're committed to keeping it that way for the developers who build on it.

[Hacktron AI @HacktronAI]

Introducing Hacktron Review: an AI security reviewer for your pull requests.

It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production.

Try for free: https://t.co/ZHfG7cvXRe

[Alex Kahn @alex_n_kahn]

.@Solana Anchor v2 pro tip #1: Slabstraction

`Slab<Header, Entry>` account abstractions overload everything you need for dynamic lists, shrinking blocks of CPIs into a single attribute

Shout out to @NotDeGhost for this, and for fixing everything I find in beta testing

[Robert Chen @NotDeGhost]

The pre-release version of Anchor v2 is out.

v2 is over 90% smaller and 3-6x faster than v1, and represents months of work focused on speed, extensibility, and security. This is a major architectural change from a dense macro-based framework to a more easily extensible trait system, with security built in from day one.

Excited for teams to give it a try. Still a few rough edges, but please DM/comment with any feedback!

[asymmetric research @asymmetric_re]

CU optimizations come with risks.

@_fel1x discusses a critical bug we found in p-token before mainnet, subtle enough to survive in a heavily scrutinized codebase.

[Jacob Creech @jacobvcreech]

I'm going to be clear because this is getting out of hand:

1. I am not pressuring Quasar to be discontinued in favor of Anchor V2. In fact, we help with funding for both Quasar development and Anchor V2 today
2. I would rather have "one framework to rule them all" that tackles performance, safety, and best-in-class DX for all developers than two frameworks that fragment the ecosystem.

For 2, I lean Quasar instead of doing the work on Anchor V2. It's already built, higher performance, and great DX. If I can get audits and safety on Quasar once stable, it's a win-win for developers everywhere. It also dramatically simplifies developer docs and onboarding new developers.

Anchor V2 has a clock of now 2 more weeks to prove that there's enough of a difference to care about it and otherwise I will drop the support of development in favor of Quasar.

[tiago.oak @qtmoses]

Anchor v1.0 is here! 🎉

Update via AVM:

cargo install avm --git https://t.co/RfRyI7Pia1 --locked
avm update

Or directly via cargo install:

cargo install anchor-cli --git https://t.co/RfRyI7Pia1 --locked --tag v1.0.0

[OtterSec @osec_io]

We achieved a guest-to-host escape by exploiting a QEMU 0-day where the bytes written out of bounds were uncontrolled.

Full breakdown of the technique, glibc allocator behavior, and our heap spray/RIP-control primitive ↓

[Swaroop Maddu @madduswaroop]

@amaan8429 You can’t receive any new emails

[Jacob Creech @jacobvcreech]

Proposal to reduce rent by 50% has been approved

Look out for halved rent in 4.0 🎉🎉🎉

https://t.co/GaIZHiSK9g

[OtterSec @osec_io]

Our community CTF is now live at @SolanaConf 🔥

Come by the Dev Cave on the mezzanine level, hosted by OtterSec, @anza_xyz, @asymmetric_re, @jump_firedancer, and @raikucom. ​

Drop by to work, meet other builders, and grab some swag.

[OtterSec @osec_io]

We’re excited to announce a shared leadership structure with @asymmetric_re! Teams today face risks that span audits, research, engineering, and incident response, and clear coordination is important.

[OtterSec @osec_io]

NEW: ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs.

We break down common pitfalls in real-world implementations and how to design production-ready paymasters.
https://t.co/YLoWOdXq4T

[Jacob Creech @jacobvcreech]

Knowing the code of programs you're interacting with is important

Not only can you view program's code on the explorer, but you can now view the full list of verified programs

Verify your programs today!

[Swaroop Maddu @madduswaroop]

@radhika_bajaj Just sneak into his Amazon wishlist and grab something he’d love 😄

[Jacob Creech @jacobvcreech]

anchor init in Anchor 1.0 will now generate a better formatted Solana program for you instead of everything in lib . rs

This will teach better practices on formatting your program for newer Rust devs

You can still use the old way with --template single

[OtterSec @osec_io]

NEW: OAuth misconfigurations show how common dev settings can lead to account takeovers.

Our second deep dive breaks down real cases where overlooking differences between desktop and mobile environments left SDKs, exchanges, and wallets open to exploits.
https://t.co/QWABEOXcSU

[Swaroop Maddu @madduswaroop]

@AlongImna

[Swaroop Maddu @madduswaroop]

@cneuralnetwork Hauser XO

[OtterSec @osec_io]

NEW: The recent supply-chain attack on NPM exposed a fundamental vulnerability in the open-source ecosystem and the risks that lurk within our dependencies.

We break down how the malware worked and practical defenses every dev should know ↓
https://t.co/ZeqAkFR2jo