The Solana Foundation has launched a series of security measures, just days after a $270 million exploit on the Drift Protocol, a decentralized finance platform, which was carried out by a North Korean state-affiliated group following a six-month social engineering campaign. At the core of this initiative is Stride, a structured evaluation program led by Asymmetric Research that assesses Solana DeFi protocols against eight security pillars and makes its findings publicly available. Additionally, the Solana Incident Response Network (SIRN) has been introduced, a membership-based group of security firms and researchers focused on real-time crisis response. While these initiatives address part of the issue exposed by the Drift hack, they do not rectify the human element that led to the loss.
The attackers spent six months building relationships with Drift contributors and compromised their devices through malicious means. Under Stride, protocols with over $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring, funded by Solana Foundation grants, with coverage tailored to each protocol's risk profile. For protocols with over $100 million in TVL, the foundation will also fund formal verification, ensuring the correctness of smart contracts by checking every possible execution path.
The network, which includes founding members such as OtterSec, Neodyme, Squads, and ZeroShadow, is available to all Solana protocols but prioritized based on TVL. However, it's noted that Stride's formal verification would not have prevented the North Korean attack, which exploited compromised devices to obtain multisig approvals.
Neither would 24/7 monitoring of on-chain activity, as the transactions were valid by design. The attack highlighted the gap between on-chain correctness and off-chain human trust, which existing smart contract audits and monitoring tools are not designed to address. The Solana Incident Response Network could have potentially aided in the response to the attack, particularly in shortening the response time. The foundation emphasized that these programs do not shift the underlying responsibility away from the protocols themselves, a point that takes on added significance in light of the Drift postmortem, which revealed that individual contributor devices were the entry point for the nation-state attack.
Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.