In response to the recent $270 million Drift Protocol exploit, the Solana Foundation has unveiled a comprehensive suite of security initiatives. The centerpiece of this effort is Stride, a rigorous evaluation program led by Asymmetric Research that will assess Solana DeFi protocols against eight key security pillars and publicly disclose its findings. Additionally, the Solana Incident Response Network (SIRN) has been introduced, a membership-based group of security firms and researchers focused on providing real-time crisis response.
While these initiatives address some of the vulnerabilities exposed by the Drift hack, they do not directly address the human element that was exploited. The attackers had spent six months building relationships with Drift contributors and compromised their devices through a malicious code repository and a fake TestFlight app.
Under the Stride program, protocols with over $10 million in total value locked (TVL) that pass the evaluation will receive ongoing operational security and active threat monitoring, funded by Solana Foundation grants. Protocols with over $100 million in TVL will also receive funding for formal verification, a mathematical method that checks every possible execution path in a smart contract to ensure correctness. The founding members of SIRN include Asymmetric Research, OtterSec, Neodyme, Squads, and ZeroShadow, and the network is available to all Solana protocols, prioritized by TVL. However, it is noted that Stride's formal verification would not have prevented the North Korean attack, which exploited the gap between on-chain correctness and off-chain human trust.
The attack used compromised devices to obtain multisig approvals that were then locked into durable nonce transactions and executed weeks later. Neither would 24/7 monitoring of on-chain activity have caught the attack, as the transactions were valid by design and indistinguishable from legitimate administrative actions until they were used to drain the vaults. SIRN, however, could have potentially shortened the response time to the attack.
The foundation emphasizes that these programs do not transfer the underlying responsibility away from the protocols themselves, highlighting the importance of individual contributor device security. Solana already offers several free security tools for builders, including Hypernative for threat detection, Range Security for real-time monitoring, and Neodyme's Riverguard for attack simulation.