In the wake of a $270 million exploit on the Drift Protocol, the Solana Foundation has unveiled a robust suite of security measures. The centerpiece of this initiative is Stride, a meticulous evaluation program led by Asymmetric Research, designed to assess Solana DeFi protocols against eight stringent security pillars, with findings to be publicly disclosed.
Additionally, the Solana Incident Response Network (SIRN) has been established, a membership-based collective of security experts and researchers focused on providing real-time crisis response. While these measures address certain vulnerabilities exposed by the Drift incident, they do not directly rectify the underlying issues that led to the loss. Notably, Drift's smart contracts were not compromised, and its code had passed audits, indicating that the vulnerability was of a human nature. The attackers had invested six months in building relationships with Drift contributors, ultimately compromising their devices through a malicious code repository and a fake TestFlight app.
Under the Stride program, protocols with over $10 million in total value locked (TVL) that successfully pass the evaluation will be eligible for ongoing operational security and active threat monitoring, subsidized by Solana Foundation grants, with the level of coverage tailored to each protocol's unique risk profile. For protocols boasting more than $100 million in TVL, the foundation will also provide funding for formal verification, a rigorous mathematical method that scrutinizes every possible execution path in a smart contract to guarantee its correctness.
The founding members of SIRN include esteemed security firms such as OtterSec, Neodyme, Squads, and ZeroShadow, with the network being accessible to all Solana protocols, albeit prioritized based on TVL. It is worth noting that Stride's formal verification would not have detected the North Korean attack, which exploited compromised devices to obtain multisig approvals that were later locked into durable nonce transactions and executed weeks later. Similarly, 24/7 monitoring of on-chain activity would not have identified the transactions, as they were designed to appear legitimate and were indistinguishable from authentic administrative actions until they were utilized to drain the vaults. The attack effectively exploited the gap between on-chain correctness and off-chain human trust, a vulnerability that existing smart contract audits and monitoring tools are not equipped to address.
However, SIRN could have potentially facilitated a more effective response to the incident. On-chain security expert ZachXBT criticized stablecoin issuer Circle Internet (CRCL) for failing to freeze over $230 million of its stolen dollar-pegged USDC during the six-hour window following the attack. A dedicated incident response network with established relationships to bridge operators, exchanges, and stablecoin issuers might have expedited the response time, although it remains uncertain whether it would have been sufficient to prevent the subsequent Wormhole bridging and obfuscation through Tornado Cash.
The foundation emphasized that these programs do not absolve protocols of their inherent responsibility, a sentiment that resonates differently in light of the Drift postmortem, which revealed that individual contributor devices served as the entry point for a nation-state attack. Solana already offers a range of free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.