Pith. sign in

REVIEW 4 major objections 6 minor 33 references

SolPhishHunter: Towards Detecting and Understanding Phishing on Solana

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Solana phishing has three transaction-level signatures that a simple rule engine can detect, catching 8,058 frauds worth about $1.1 million.

desk verdict First academic dataset and taxonomy for Solana phishing, but the headline counts and precision rest on an unvalidated labeling step that needs fixing before the numbers are trusted. read the letter →

arxiv 2505.04094 v1 pith:VUE2PHPZ submitted 2025-05-07 cs.CR cs.SE

Ziwei Li , Zigui Jiang , Ming Fang , Jiaxin Chen , Zhiying Wu , Jiajing Wu , Lun Zhang , Zibin Zheng This is my paper · ORCID
classification cs.CRcs.SE
keywords Solanaphishingdetectiontransaction-levelaccountauthoritytransfersystemimpersonationmultipletransfersblockchainsecuritygangs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that phishing on Solana is not just Ethereum phishing transplanted: Solana's support for multiple instructions in one transaction and its owner-based account model have produced at least three new transaction-level fraud patterns, which the authors call SolPhish. They define the three types—single transaction with multiple transfers, account authority transfer, and impersonation of system accounts—and build a small rule-based detector, SolPhishHunter, around them. Applied to the historical transactions of 169 labeled phishing accounts, the tool flags 8,058 transactions as SolPhish at roughly 93.96% precision, and those transactions caused about $1.1 million in victim losses. The claim matters because it is the first systematic, transaction-level picture of Solana phishing and because the rules are simple enough to run inside wallets before a user signs.

What carries the argument

The load-bearing object is a set of four prerequisite filters plus three type-specific rule patterns. The prerequisite filters remove benign market activity by requiring that neither beneficiary nor loser is a trading market, that the transaction log lacks buy/sell/purchase keywords, and that sender and receiver differ. Then STMT requires more than two transfer instructions and at least two token balances falling to zero; AAT checks for an Assign instruction or an account-owner SetAuthority instruction; ISA checks for a transfer that empties SOL or a token into an address matching "Compu.*" or ".*1111". These rules are the whole engine: they turn Solana's instruction, log, and balance records directly into labels, and the paper's empirical analysis is built entirely on their outputs.

What would settle it

Take a random sample of roughly 386 of the 8,058 flagged transactions, reconstruct each one from Solana's public records, and independently classify whether it actually drained victim funds or transferred account authority to a phisher-controlled program, without relying on the source account's label. If independently verified precision falls well below 93.96%, or if the audit cannot reproduce the transaction-type distribution, the paper's central precision claim and count are not supported.

Watch

Extended reading notes

Core claim

The paper claims that Solana's unique transaction and account design creates three concrete phishing transaction types that can be detected with explicit rules: STMT, a single transaction containing more than two transfer instructions that drains at least two token types; AAT, a transaction carrying an Assign instruction or a SetAuthority instruction with authorityType set to "account owner", transferring ownership of a wallet or token account to a phisher; and ISA, a transaction whose beneficiary address mimics a system account by starting with "Compu" or ending with "11111" while draining tokens. Using these rules, SolPhishHunter detects 8,058 phishing transactions in the historical records of 169 known phishing accounts, with 93.96% precision after excluding market transactions, and the authors report those transactions caused nearly $1.1 million in losses. They also construct what they describe as the first Solana phishing transaction dataset and report 64 phishing accounts to security services in the ecosystem.

Load-bearing premise

The entire result rests on the assumption that a transaction matching a rule and touching an account already labeled as phishing is itself phishing; if the seed label list from user reports and the block explorer is incomplete or contains mistaken labels, both the 93.96% precision and the 8,058 count drift.

Editorial extensions

If this is right

  • A wallet-integrated version of the tool could warn users before signing, because all three signatures are visible in the transaction before execution.
  • Security scanners and block explorers can add Assign and account-owner SetAuthority to high-risk instruction lists; AAT, although the least frequent type, accounts for about 74% of the measured losses.
  • The released transaction dataset gives graph and machine-learning researchers a labeled Solana set for training phishing-account and phishing-gang detection models.
  • Blacklist coverage improves: 46 of the 64 reported phishing accounts were not already flagged by the block explorer, so transaction-level rules find accounts that reputation feeds miss.
  • The three explicit transaction shapes can be encoded directly into real-time alerts by wallet and security services, not just retrospective scanners.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 93.96% precision likely overstates true precision for the whole network, because a rule match on a pre-labeled phishing account is counted as a true positive without independent verification; on 200 normal accounts the tool already produced five false positives.
  • If the same rules were run over all Solana transactions rather than only known-phisher histories, false positives from legitimate multi-token sweeps, vault assignments, and vanity addresses could grow, so the 8,058 figure is best read as a floor, not the true prevalence of SolPhish.
  • Loss estimates use current token prices applied to historical transfers, so the reported $1.1 million may differ from what victims actually lost at the time; illiquid meme coins in AAT cases could inflate the figure.
  • Phishers can likely evade detection by generating vanity addresses with prefixes outside the two patterns or by splitting multi-token drains into separate transactions, which makes the detector a moving target rather than a permanent solution.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper defines three Solana-specific phishing transaction types (STMT, AAT, ISA), proposes a rule-based detector called SolPhishHunter, and evaluates it on transactions of 169 seed phishing accounts (TDPA) and 200 high-asset normal accounts (TDNA). It reports detecting 8,058 SolPhish transactions with 93.96% precision, estimates nearly $1.1 million in victim losses, analyzes temporal and gang-level patterns, and announces a public dataset, SolPhishDataset.

Significance. If the evaluation were independently validated, this would be a useful first systematic study of Solana transaction-level phishing: the three proposed types are concrete, checkable on-chain, and the empirical observations about AAT's outsized financial impact and the existence of phishing gangs are informative for the security community. The paper is also commendable for giving explicit detection rules and for manually reviewing the five TDNA false positives. However, the headline metrics (8,058 instances and 93.96% precision) are not yet supported because the positive labels come from the same seed account list used to build TDPA, the loss figures use current token prices rather than prices at attack time, and the detection thresholds are not sensitivity-tested.

major comments (4)
  1. [IV-B1/IV-B3, Table IV] The precision estimate is circular with respect to the ground-truth construction. TDPA is built from 169 accounts already labeled as phishing on Chainabuse/Solscan, and the 8,058 'true positives' are classified by checking whether the beneficiary or authority recipient of a flagged transaction is one of these same labeled accounts (or a labeled phishing program). No independent per-transaction verification is reported for the TDPA positives, in contrast to the five TDNA positives that receive expert review. Consequently, the 93.96% precision and the 8,058 count are not measured against an independent standard; they are partly an artifact of the seed list. The authors should manually review a random sample of the positives (stratified by type), report per-type precision with confidence intervals, and state how seed-list incompleteness bounds recall.
  2. [V-B, Table VI] The financial loss estimates are computed with current token prices ('we query the latest prices of various tokens using the token query interface provided by Oklink') rather than prices at the time each transaction occurred. For volatile tokens, including the meme coins highlighted in Table VII, current prices can differ by orders of magnitude from attack-time prices, so the 'nearly $1.1 million' figure is not a reliable measure of actual victim loss. For AAT transactions the loss is also taken as the current total value of tokens in the transferred accounts. The authors should recompute losses using historical prices at the transaction block timestamp (e.g., via a price oracle with historical data) or provide a sensitivity analysis bracketing the estimates with attack-time and current-price valuations.
  3. [IV-A2-IV-A4, Table II] The STMT rule's thresholds ('more than two transfer instructions' and 'depletion of two or more types of tokens') and the ISA address-pattern rule ('Compu.*' or '.*1111') are presented without justification or sensitivity analysis. Since the headline count of 8,058 and the derived loss and gang statistics all depend on these thresholds, the paper should include an ablation or threshold sweep showing how the detected counts and precision change as these parameters vary, or justify the thresholds by a distributional analysis of benign versus phishing transactions.
  4. [VI-A] The paper claims to publicly release SolPhishDataset and to report results to Solscan and GoPlus, but no dataset URL, repository, or artifact link is provided anywhere in the manuscript. Without a link or clear access instructions, the 'first Solana phishing dataset in academia' contribution and the reproducibility of the empirical analysis cannot be verified. A public artifact link and a description of the dataset schema should be added.
minor comments (6)
  1. [Table II] The prerequisite row writes 'tx.from == tx.to', but the text in Section IV-A1 states that a transaction is deemed non-phishing when the beneficiary and loser are the same. The table appears to invert the condition; it should be 'tx.from != tx.to'.
  2. [IV-B3] The dataset name is inconsistently spelled 'TDFA' in the 'Results on TDFA' heading and in the opening of Section V; it should be 'TDPA'.
  3. [IV-B3] The suspicious-transaction counts are inconsistent: the text reports 8,571 suspicious TDPA transactions, then later refers to 'these 8,573 suspicious transactions', and the summary uses 8,576 total suspicious transactions including TDNA. These numbers should be reconciled.
  4. [V-A, Finding 1] Finding 1 says 'from ISA to ATMT to AAT'; 'ATMT' should be 'STMT'.
  5. [Table VI] The loss values in Table VI contain formatting corruptions (e.g., '$150 , 19.12', '$751 , 88.51', '$106 , 34.25'); these should be corrected to standard decimal notation.
  6. [V-D] The gang analysis would benefit from a precise definition of what constitutes a 'gang' (e.g., minimum number of interactions or thresholds for edge creation) and from reporting how the 11 gangs were extracted from Figure 8.

Circularity Check

1 steps flagged · score 5.0 of 10

Precision and count are self-referential: TDPA true positives are defined by the same seed phishing labels used to build the test set.

  1. self definitional [Section IV-B3, 'Results on TDPA' and 'Summary' (Table IV)]
    "Based on the types of beneficiaries and losers in the transactions, these 8,573 suspicious transactions are labeled and classified. Of these, 8,058 transactions (94.01%) are identified as phishing transactions... SolPhishHunter marks a total of 8,576 suspicious transactions, among which 8,058 are SolPhish transactions, with a precision of approximately 93.96%."

    TDPA is built from the historical transactions of the 169 seed-labeled phishing accounts (Section IV-B1). In Section IV-B3, every flagged TDPA transaction that is not a mutual transfer between labeled phishers and not a transfer from a labeled phisher to another entity is automatically counted as a phishing transaction. No independent manual or external verification is applied to these 8,058 positives; only the 5 TDNA flags receive expert review. Therefore the 'true positive' label is defined by the same seed list used to construct the test set, and the reported precision (8058/8576 = 93.96%) and the total of 8,058 SolPhish transactions are a restatement of the seed-label-derived classification rather than an independent measurement. The loss figure (~$1.1M) inherits this circularity.

full rationale

The detection rules in Table II are defined from structural transaction features and are not statistically fitted to the labels; the TDNA evaluation provides an independent false-positive check. However, the paper's headline precision and total count rest on labeling every non-mutual, non-money-laundering flagged TDPA transaction as a true SolPhish transaction without manual or external verification. Since TDPA consists exclusively of historical transactions of the same seed-labeled phishing accounts, a flagged TDPA transaction is counted as a true positive precisely when it involves a seed phisher, which is true by construction for the dataset. Thus the 93.96% precision and the 8,058-instance figure are definitionally determined by the input seed list rather than by independent ground truth. This is a serious circularity in the evaluation, but it does not invalidate the rule definitions themselves or the TDNA false-positive analysis; other self-citations and references are not load-bearing for the central derivation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rely on hand-chosen rule thresholds (counts and address patterns) and on three domain assumptions: that external labels identify true phishing accounts, that high-value accounts represent normal behavior, and that current token prices measure historical losses. No new physical or computational entities are introduced.

free parameters (3)
  • STMT transfer instruction threshold = >2 transfer instructions
    Table II: the STMT rule fires when a single transaction contains more than two transfer instructions. This threshold is hand-set and not derived from data.
  • STMT token type depletion count = >=2 token types drained
    Table II: requires at least two token balance entries going from nonzero to zero. Hand-set to reduce false positives from normal transfers.
  • ISA address pattern = address matches 'Compu.*' or ends with '1111'
    Table II: recipient address matching rule. The paper's text says suffix '11111' while the rule table says '.*1111'; the pattern is chosen from observed vanity addresses, not fitted.
assumptions (4)
  • domain assumption Chainabuse and Solscan labels identify genuine phishing accounts
    Section IV-B1 uses 169 labeled accounts as the phishing seed set; if these labels are noisy, all downstream counts inherit the noise.
  • domain assumption The top 200 highest-value Solana accounts represent normal behavior
    Section IV-B1(ii) uses these as the normal comparison set; high-value accounts are not representative of typical users and may understate false positives.
  • domain assumption Current token prices measure the historical financial loss
    Section V-B values transfers and drained accounts at the latest prices from Oklink, ignoring price at attack time and ignoring whether AAT-drained assets could actually be liquidated.
  • domain assumption The four prerequisite rules correctly exclude all benign market transactions
    Section IV-A1 assumes that market trades, NFT purchases, and self-transfers never match the phishing patterns; the five TDNA false positives show this assumption is not perfect.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SolPhishHunter: Towards Detecting and Understanding Phishing on Solana." pith.science (2026). https://pith.science/paper/VUE2PHPZ

@misc{pith2026250504094,
  author       = {Pith},
  title        = {Pith review of: SolPhishHunter: Towards Detecting and Understanding Phishing on Solana},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VUE2PHPZ}},
  note         = {Machine review of arXiv:2505.04094}
}
abstract

Solana is a rapidly evolving blockchain platform that has attracted an increasing number of users. However, this growth has also drawn the attention of malicious actors, with some phishers extending their reach into the Solana ecosystem. Unlike platforms such as Ethereum, Solana has distinct designs of accounts and transactions, leading to the emergence of new types of phishing transactions that we term SolPhish. We define three types of SolPhish and develop a detection tool called SolPhishHunter. Utilizing SolPhishHunter, we detect a total of 8,058 instances of SolPhish and conduct an empirical analysis of these detected cases. Our analysis explores the distribution and impact of SolPhish, the characteristics of the phishers, and the relationships among phishing gangs. Particularly, the detected SolPhish transactions have resulted in nearly \$1.1 million in losses for victims. We report our detection results to the community and construct SolPhishDataset, the \emph{first} Solana phishing-related dataset in academia.

Figures

Figures reproduced from arXiv: 2505.04094 by the authors.

Figure 1
Figure 1. Solana phishing scam process user wallets or inducing them to sign malicious transactions. This results in significant financial losses for the victims. According to the annual report [3] released by a security firm called Certik, phishing was the most damaging attack method on Web3 in 2024. Phishing scams have also emerged on Solana. As of January 2024, two major Solana wallet phishing tools—Rainbow Drainer and Nod… view at source ↗
Figure 2
Figure 2. The phishing transaction f2MA...PaiC succeeded in draining multiple [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. SolPhish based on AAT (4GVr...tYAn) TABLE I SOME SYSTEM ACCOUNTS AND PHISHING ACCOUNTS System Accounts 111111111111111111111111111111111 ComputeBudget111111111111111111111111111111 NativeLoader111111111111111111111111111111 Phishing Accounts Qcsb89L6QS74b56...CnBSqnQ5gq11111 CaNCU6LiZUKc7Su...eAmv625c4M11111 TdnNjtovxBmRZmg...a4CCfTUNxU11111 np84cd63UoFj2pb...w6j2hN4poa11111 iBGtY2LBEmTiVrm...EmmkDxbLhV11111 CompuV3… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: The framework of SolPhishHunter B. Evaluation of SolPhishHunter In this subsection, we will explore the effectiveness of SolPhishHunter. 1) Datasets: The dataset used for evaluation primarily consists of the historical transactions of accounts. Initially, we collect da…
Figure 5
Figure 5. Figure 5: Time distribution of SolPhish evolving trends of Solana phishing scams. Specifically, we investigate the temporal distribution of SolPhish, the economic losses SolPhish cause, the characteristics of the phishers, and the relationships within phishing gangs. A. Temporal…
Figure 6
Figure 6. Figure 6: The losses caused to victims of SolPhish [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 8
Figure 8. Figure 8: Relationship betweent the labeled phishers [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: Phisher gangs up to approximately one year. ISA-based accounts quickly become inactive after their last phishing transaction, forming a contrasting pattern to STMT-based phishing accounts. Finding 3. The profits of phishers based on STMT are unstable, while the damage …
Figure 10
Figure 10. Figure 10: Composition of SolPhishDatset account suffix. Overall, the gang forms an inwardly radiating star-shaped topology. Finding 4. Some gang relationships exist among the labeled phishers, with a total of 11 gangs identified. The three largest gangs involve 19 phishing acco…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

33 extracted references · 21 canonical work pages

  1. [1]

    [Online]

    (2025) Solana whitepaper. [Online]. Available: https://solana.com/ solana-whitepaper.pdf

    work page 2025

  2. [2]

    [Online]

    (2025) Solana 2024 recap. [Online]. Available: https://coinmarketcap. com/academy/article/week-in-solana-2024-recap

    work page 2025

  3. [3]

    [Online]

    (2025) The web3 security report 2024 from cer- tik. [Online]. Available: https://www.certik.com/resources/blog/ hack3d-the-web3-security-report-2024

    work page 2025

  4. [4]

    [Online]

    (2024) Report of solana wallet drainers from scamsniffer. [Online]. Available: https://drops.scamsniffer.io/ over-4-million-stolen-by-multiple-solana-wallet-drainers/

    work page 2024

  5. [5]

    Bilstm4dps: An attention- based bilstm approach for detecting phishing scams in ethereum,

    M. Tang, M. Ye, W. Chen, and D. Zhou, “Bilstm4dps: An attention- based bilstm approach for detecting phishing scams in ethereum,” Expert Systems with Applications , vol. 256, p. 124941, 2024

    work page 2024

  6. [6]

    2dynethnet: A two-dimensional streaming framework for ethereum phishing scam detection,

    J. Yang, W. Yu, J. Wu, D. Lin, Z. Wu, and Z. Zheng, “2dynethnet: A two-dimensional streaming framework for ethereum phishing scam detection,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  7. [7]

    Ewdps: A novel framework for early warning and detection on ethereum phishing scams,

    C. Xu, R. Li, L. Zhu, X. Shen, and K. Sharif, “Ewdps: A novel framework for early warning and detection on ethereum phishing scams,” IEEE Internet of Things Journal , 2024

    2024

  8. [8]

    A novel hybrid feature fusion model for detecting phishing scam on ethereum using deep neural network,

    T. Wen, Y . Xiao, A. Wang, and H. Wang, “A novel hybrid feature fusion model for detecting phishing scam on ethereum using deep neural network,” Expert Systems with Applications , vol. 211, p. 118463, 2023

    2023

Show all 33 references
  1. [9]

    Who stole my nft? investigating web3 nft phishing scams on ethereum,

    J. Yang, J. Liu, D. Lin, J. Wu, B. Huang, Q. Li, and Z. Zheng, “Who stole my nft? investigating web3 nft phishing scams on ethereum,” IEEE Transactions on Information Forensics and Security , 2024

    2024

  2. [10]

    Dissect- ing payload-based transaction phishing on ethereum,

    Z. Chen, Y . Hu, B. He, D. Luo, L. Wu, and Y . Zhou, “Dissect- ing payload-based transaction phishing on ethereum,” arXiv preprint arXiv:2409.02386, 2024

    2024 arXiv

  3. [11]

    Fishing for fraudsters: Uncovering ethereum phishing gangs with blockchain data,

    J. Liu, J. Chen, J. Wu, Z. Wu, J. Fang, and Z. Zheng, “Fishing for fraudsters: Uncovering ethereum phishing gangs with blockchain data,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 3038–3050, 2024

    2024

  4. [12]

    Siege: Self-supervised in- cremental deep graph learning for ethereum phishing scam detection,

    S. Li, R. Wang, H. Wu, S. Zhong, and F. Xu, “Siege: Self-supervised in- cremental deep graph learning for ethereum phishing scam detection,” in Proceedings of the 31st ACM International Conference on Multimedia , 2023, pp. 8881–8890

    2023

  5. [13]

    Ttagn: Temporal transaction aggregation graph network for ethereum phishing scams detection,

    S. Li, G. Gou, C. Liu, C. Hou, Z. Li, and G. Xiong, “Ttagn: Temporal transaction aggregation graph network for ethereum phishing scams detection,” in Proceedings of the ACM Web Conference 2022 , 2022, pp. 661–669

    2022

  6. [14]

    Txphishscope: Towards detecting and understanding transaction-based phishing on ethereum,

    B. He, Y . Chen, Z. Chen, X. Hu, Y . Hu, L. Wu, R. Chang, H. Wang, and Y . Zhou, “Txphishscope: Towards detecting and understanding transaction-based phishing on ethereum,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , 2023, pp. 120–134

    2023

  7. [15]

    Who are the phishers? phishing scam detection on ethereum via network embedding,

    J. Wu, Q. Yuan, D. Lin, W. You, W. Chen, C. Chen, and Z. Zheng, “Who are the phishers? phishing scam detection on ethereum via network embedding,” IEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 52, no. 2, pp. 1156–1166, 2020

    2020

  8. [16]

    Know your transactions: Real-time and generic transaction semantic representation on blockchain & web3 ecosystem,

    Z. Wu, J. Liu, J. Wu, Z. Zheng, X. Luo, and T. Chen, “Know your transactions: Real-time and generic transaction semantic representation on blockchain & web3 ecosystem,” in Proceedings of the ACM Web Conference 2023, 2023, pp. 1918–1927

    2023

  9. [17]

    [Online]

    (2025) Chainabuse. [Online]. Available: https://www.chainabuse.com/ category/phishing?page=0&filter=SOL

    2025

  10. [18]

    [Online]

    (2025) Solscan. [Online]. Available: https://solscan.io/

    2025

  11. [19]

    Characterizing ethereum address poisoning attack,

    S. Guan and K. Li, “Characterizing ethereum address poisoning attack,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 986–1000

    2024

  12. [20]

    [Online]

    (2025) A report from a twitter user regarding gck5...1vx4. [Online]. Available: https://x.com/GBENONCHI/status/1780186273929367980

    2025

  13. [21]

    [Online]

    (2025) A report from a twitter user regarding gck5...1vx4. [Online]. Available: https://x.com/SmokyHead Art/status/1733896906810810667

    2025

  14. [22]

    [Online]

    (2025) A report from a twitter user regarding glqf...3buh. [Online]. Available: https://x.com/moonspace888/status/1827356507668648192

    2025

  15. [23]

    [Online]

    (2025) A report from a twitter user regarding hbts...2oap. [Online]. Available: https://x.com/0xmiir/status/1815924439248429344

    2025

  16. [24]

    [Online]

    (2025) Jito-tip-router. [Online]. Available: https://github.com/ jito-foundation/jito-tip-router

    2025

  17. [25]

    [Online]

    (2024) Report of solana phish from goplus. [Online]. Available: https://en.theblockbeats.news/news/54461

    2024

  18. [26]

    [Online]

    (2024) Report of solana phish from goplus. [Online]. Available: https://www.theblockbeats.info/news/49728

    2024

  19. [27]

    [Online]

    (2024) Report of solana phish from keystone. [Online]. Available: https://www.theblockbeats.info/news/54055

    2024

  20. [28]

    [Online]

    (2024) Report of solana drainer from cyber security. [Online]. Available: https://cyble.com/blog/solana-drainers-source-code. -saga-tracing-its-lineage-to-the-developers-of-ms-drainer/

    2024

  21. [29]

    [Online]

    (2025) Oklink. [Online]. Available: https://www.oklink.com/

    2025

  22. [30]

    [Online]

    (2025) 2025 crypto crime trends. [Online]. Available: https://www. chainalysis.com/blog/2025-crypto-crime-report-introduction/

    2025

  23. [31]

    Vrust: Automated vulnerability detection for solana smart contracts,

    S. Cui, G. Zhao, Y . Gao, T. Tavu, and J. Huang, “Vrust: Automated vulnerability detection for solana smart contracts,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 639–652

    2022

  24. [32]

    Fuzz on the beach: Fuzzing solana smart contracts,

    S. Smolka, J.-R. Giesen, P. Winkler, O. Draissi, L. Davi, G. Karame, and K. Pohl, “Fuzz on the beach: Fuzzing solana smart contracts,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 1197–1211

    2023

  25. [33]

    Defying the odds: Solana’s unexpected resilience in spite of the security challenges faced by developers,

    S. Andreina, T. Cloosters, L. Davi, J.-R. Giesen, M. Gutfleisch, G. Karame, A. Naiakshina, and H. Naji, “Defying the odds: Solana’s unexpected resilience in spite of the security challenges faced by developers,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer a...

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.