Builders build with ChainProbe
Why existing tools miss vulnerabilities
Deterministic analysis
No AI hallucinations, no pattern matching. Uses syn to parse every .rs file into a full Rust AST — the same parser the Rust compiler uses.
Multi-stage pipeline
Eight analysis stages — AST extraction, trust classification, taint analysis, invariant mining, call graph, pattern detection, chain detection, and exploitability scoring.
Exploit proof, not descriptions
Generates runnable #[tokio::test] PoCs that prove each vulnerability is real, plus side-by-side fix diffs with actual corrected Anchor code.
For Solana Developers | Auditors | Protocol Teams
The 8-Stage Analysis Pipeline
Taint Analysis & Invariant Mining
Tracks attacker-controlled values through instruction params, unverified accounts, and arithmetic operations. Extracts every require!() condition and checks whether bypass paths exist.
Call Graph & CPI Analysis
Builds directed graphs of instruction-to-CPI flows, binds account parameters across CPI boundaries, and computes the minimum attacker-controlled accounts needed to reach each security-sensitive operation.
Exploitability Scoring & PoC Generation
Every finding includes an exploitability score, required attacker footprint, and a runnable test that proves the vulnerability — plus the actual corrected Anchor code as a fix diff.
See it in action
Every vulnerability is proven with a runnable PoC test and a side-by-side fix diff.
Sample Findings
Unsigned Authority
CriticalAccountInfo used as authority field — no signature verification required
View full reportOverflow Chain
HighUnchecked arithmetic on user-controlled values reaches token transfer sink
View full reportPDA Collision
CriticalSeeds contain user-supplied mint — attacker can derive same PDA address
View full reportEvery finding comes with a PoC test and a fix diff.
Run analysis
wherever you build
Web Interface
Upload your program folder or paste code directly. Get a full visual report in your browser.
REST API
POST /api/analyze with your .rs files. Get back a structured AnalysisReport in JSON.
Local Binary
Run chainprobe directly on your machine. No data leaves your system. Full offline analysis.
Trusted by Solana builders
ChainProbe caught an unsigned authority vulnerability in our escrow program that two previous audits missed. The PoC test proved it immediately, and the fix diff gave us the exact code change. This is the kind of tool the Solana ecosystem has been waiting for.