In the wake of a devastating $270 million exploit of the Drift Protocol, the Solana Foundation has unveiled a robust suite of security measures. The centerpiece of this initiative is Stride, a rigorous evaluation program led by Asymmetric Research, which will assess Solana DeFi protocols against eight critical security pillars and publicly disclose its findings. Additionally, the foundation has introduced the Solana Incident Response Network (SIRN), a membership-based collective of security experts and researchers focused on providing real-time crisis response. While these measures address some of the vulnerabilities exposed by the Drift hack, they do not directly address the root cause of the breach, which was a result of a six-month social engineering campaign by a North Korean state-affiliated group that compromised the devices of Drift contributors.
The attackers exploited human vulnerabilities, rather than technical ones, by using a malicious code repository and a fake TestFlight app to gain access to the contributors' devices. Under the Stride program, protocols with over $10 million in total value locked (TVL) that pass the evaluation will be eligible for ongoing operational security and active threat monitoring, funded by Solana Foundation grants, with coverage tailored to each protocol's risk profile.
For protocols with over $100 million in TVL, the foundation will also provide funding for formal verification, a mathematical method that verifies the correctness of every possible execution path in a smart contract. The SIRN network, which includes founding members such as OtterSec, Neodyme, Squads, and ZeroShadow, will be available to all Solana protocols, with priority given to those with higher TVL. Notably, the Stride program's formal verification would not have prevented the North Korean attack, which relied on compromised devices to obtain multisig approvals that were later used to drain the vaults. Similarly, 24/7 monitoring of on-chain activity would not have detected the attack, as the transactions were designed to appear legitimate.
The incident highlights the gap between on-chain security and off-chain human trust, which no smart contract audit or monitoring tool is equipped to address. However, the SIRN network could have potentially mitigated the response time to the attack.
The Solana Foundation has emphasized that these programs do not absolve protocols of their underlying responsibility for security, a point that takes on added significance in light of the Drift hack, which was facilitated by the compromise of individual contributor devices. The foundation already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.