SolanaTestForge

Fork state | fuzz hard | catch bugs before mainnet
Foundry instincts | solana reality

[SolanaTestForge @SolanaTestForge]

current workflow:

fork mainnet
run security scan
fuzz weird execution paths
export report
before deployment ever touches production.

[SolanaTestForge @SolanaTestForge]

we built SolanaTestForge during @colosseum Frontier Hackathon because “tests passed” means very little without adversarial conditions.

fork state.
mutate inputs.
break assumptions first.
https://t.co/NzsmdSRhVW

[SolanaTestForge @SolanaTestForge]

forking mainnet does not just make tests more realistic.
it removes assumptions.
same program.
same instructions.
completely different outcomes once real state is involved.

demo: https://t.co/2hhBHLVks5

[SolanaTestForge @SolanaTestForge]

some teams treat testing like confirmation.

we treat it like adversarial research.

if the protocol survives weird timing, weird state, and weird inputs,
then the real confidence starts.

[SolanaTestForge @SolanaTestForge]

current workflow inside SolanaTestForge:

fork state
run scanner
fuzz instructions
export report
all before deployment touches mainnet.

[SolanaTestForge @SolanaTestForge]

local validator:
everything green.
forked mainnet:
slot mismatch,
oracle drift,
unexpected CPI path.

same program.
different reality.

[SolanaTestForge @SolanaTestForge]

most teams test happy paths. some test failure paths. almost nobody tests timing.

oracle lag. slot delay. account sync. that is where things break.

[SolanaTestForge @SolanaTestForge]

instruction passed all checks.

post-state matched expectations.

except one thing:
rent-exempt threshold dropped below minimum after transfer.

not caught in test.
caught in fork.

yes, that is a bug.

[Solana @solana]

“Solana’s really the home for everything, every asset that you can imagine”

- Vibhu

[SolanaTestForge @SolanaTestForge]

coming from Foundry? fuzzing on solana is not just calldata mutation.

you are mutating:
- account state
- signer flags
- cpi boundaries

same idea. different failure modes.

[SolanaTestForge @SolanaTestForge]

forking mainnet does not just give you real state. it removes assumptions.

most programs pass on local validator.
fail within 20s on fork. that is the gap people underestimate.

[SolanaTestForge @SolanaTestForge]

found this after ~420k iterations.

cpi call succeeded.
state updated.
event emitted.

authority check failed silently. yes, that is a bug.

[SolanaTestForge @SolanaTestForge]

@HlIus_fdn @Helius nicee

[SolanaTestForge @SolanaTestForge]

@alexxandrezk good bro

[SolanaTestForge @SolanaTestForge]

@solana hope your test coverage is as aggressive as the timeline.

[SolanaTestForge @SolanaTestForge]

Testing Solana CPIs is hard: inner instructions are hidden from logs by default, transaction-level pre/post checks miss intermediate state bugs, and target programs often only exist on mainnet. Forking solves the mainnet issue, but the first two are on you.

[SolanaTestForge @SolanaTestForge]

@TokenLockr @cicada_mm @Daoshub hope the lockup logic is as robust as the event coordination.

[SolanaTestForge @SolanaTestForge]

@cicada_mm @Daoshub looks like a solid lineup - hope the pitch decks hold up under the live fire of Q&A, that’s where the real testing happens.

[SolanaTestForge @SolanaTestForge]

coming from Foundry? here is the rough mapping.

forge test → solforge test https://t.co/rVVrcDAROr() → forked account state with whatever lamports you want vm.prank() → no direct equivalent.

CPI authority is checked at instruction boundary, not impersonated at runtime.