In response to the recent $270 million Drift Protocol exploit, the Solana Foundation has launched a multifaceted security initiative. This move comes just five days after the decentralized finance (DeFi) platform fell victim to a sophisticated attack by a North Korean state-affiliated group, which utilized a six-month-long social engineering campaign to compromise the platform. The cornerstone of this initiative is Stride, a systematic evaluation program led by Asymmetric Research.
Stride will assess Solana DeFi protocols against eight key security pillars and publicly disclose its findings. Additionally, the Solana Foundation has introduced the Solana Incident Response Network (SIRN), a membership-based collective of security firms and researchers dedicated to providing real-time crisis response.
While these initiatives address certain vulnerabilities exposed by the Drift hack, they do not directly address the root cause of the exploit. The attackers successfully compromised Drift contributors' devices through a malicious code repository and a fake TestFlight app, highlighting a human vulnerability rather than a flaw in the smart contracts or code.
Under the Stride program, protocols with over $10 million in total value locked (TVL) that pass the evaluation will be eligible for ongoing operational security and active threat monitoring, funded by Solana Foundation grants. The level of coverage will be tailored to each protocol's risk profile. For protocols with over $100 million in TVL, the foundation will also fund formal verification, a rigorous mathematical method that verifies the correctness of every possible execution path in a smart contract. The founding members of SIRN include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow, with the network being available to all Solana protocols, prioritized by TVL.
Although Stride's formal verification would not have prevented the North Korean attack, which exploited compromised devices to obtain multisig approvals, the Solana Incident Response Network could have potentially accelerated the response time. The attack underscored the gap between on-chain correctness and off-chain human trust, a vulnerability that current smart contract audits and monitoring tools are not equipped to address. The Solana Foundation has emphasized that these programs do not shift the underlying responsibility away from the protocols themselves, a point that takes on added significance in the aftermath of the Drift hack, where individual contributor devices served as the entry point for a nation-state attack.
Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.