The Solana Foundation has unveiled a range of security initiatives, just days after the decentralized finance platform Drift Protocol suffered a significant $270 million exploit at the hands of a North Korean state-affiliated group. This exploit followed a six-month social engineering campaign.
Central to these initiatives is Stride, a structured evaluation program led by Asymmetric Research. Stride will assess Solana DeFi protocols against eight key security pillars, with the findings being made publicly available.
Additionally, the Solana Foundation has introduced the Solana Incident Response Network (SIRN), a membership-based group of security firms and researchers focused on providing real-time crisis response. While these initiatives address part of the issue exposed by the Drift exploit, they do not directly tackle the root cause of the loss. The vulnerability in this case was human-based, with the attackers spending six months building relationships with Drift contributors. They then compromised devices through a malicious code repository and a fake TestFlight app, highlighting the limitations of current security measures in preventing such social engineering attacks.
Under the Stride program, protocols with more than $10 million in total value locked (TVL) that pass the evaluation will be eligible for ongoing operational security and active threat monitoring, funded by Solana Foundation grants. The level of coverage will be tailored to each protocol's specific risk profile. For larger protocols with over $100 million in TVL, the foundation will also fund formal verification. This is a mathematical method that checks every possible execution path in a smart contract to ensure correctness and security.
Founding members of the SIRN include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow. While the network is available to all Solana protocols, priority will be given based on TVL.
It's worth noting that Stride's formal verification would not have prevented the North Korean attack, as it exploited the gap between on-chain correctness and off-chain human trust. Similarly, 24/7 monitoring of on-chain activity would not have caught the attack, as the transactions were valid by design and appeared legitimate until they were used to drain the vaults. However, the SIRN could have potentially improved the response to the attack.
For instance, a dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have shortened the response time and possibly mitigated some of the damage. The Solana Foundation emphasized that these programs do not shift the underlying responsibility away from the protocols themselves. This is a crucial point, especially considering that individual contributor devices were the entry point for the nation-state attack on Drift. Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation, underscoring its commitment to enhancing security across its ecosystem.