Back to Blog

Secure the Solana Ecosystem (7) — Type Confusion

April 29, 2022

0. Review

1. Overview

In the previous blog, we introduced the implementation of a general Multi-Sig. In this post, we will discuss another security issue — Type Confusion.

2. Deserialization/Serialization

In Solana, the program states are stored in accounts. The type confusion issue arises during the deserialization/serialization of accounts. The logic of the program usually rely on the data structures. However, the program may not check the type of the accounts properly during the deserialization/serialization process. This may be abused by attackers, resulting in unexpected loss.

3. Code Review (Type Confusion)

In the following, we illustrate the issue of type confusion with a simple program. You can find the test code here.

In the test program, we implement two data structs, one is User and the other is Metadata. Both of them record the public key of an account (different account).

The program has three different instructions. Instruction InitializeUser is designed for creating the User account and setting an authorized account (i.e., authority). Similarly, instruction InitializeMeta is invoked for creating the MetaData account and setting a normal account (i.e., account). Instruction Test demonstrates that the attacker can bypass the verification logic of the program and conduct attacks with controlled MetaData.

Let’s walk through the instruction Test(). The program ensures the owner of the User account passed in is the program itself (line 86 - line 89). After deserialization (line 92), the program compares the public key of the authority account passed in with the public key stored in the User account. If they are not equal, the program reverts (line 93 - line96). The last check is to ensure the authority account has signed the transaction. However, if an attacker pass in the controlled Metadata account, all the check can still be bypassed. The reason is that the program doesn't check the type of accounts. It receives an array of bytes and deserializes it directly into different types of structs defined in the program.

We deploy the test program for the further test, and it can be found in this link.

3.1 Send Transaction

After deploying the program, we write the script to invoke three instructions provided in the program in order.

We first invoke the InitializeUser and InitializeMeta. Note that we set our own public key as the account account stored in the Metadata account.

In function test(), we pass in the Metadata account as the User account and our own account as the authority_info (line 347 - line 348). The program de-serialized the Metadata with struct User and all the check can be bypassed.

We send the transaction and it can be found here. The program returned success, which means we successfully passed the check with the unchecked account type.

4. Summary

In this article, we introduce the problem of type confusion in Solana. There are many ways to avoid this problem. For example, we can add one attribute to record the type of the account in the struct, and the program should always check the type attribute before reading/writing from/to the account passed in. Keep following, and we will share more in the upcoming posts.

About BlockSec

BlockSec is a pioneering blockchain security company established in 2021 by a group of globally distinguished security experts. The company is committed to enhancing security and usability for the emerging Web3 world in order to facilitate its mass adoption. To this end, BlockSec provides smart contract and EVM chain security auditing services, the Phalcon platform for security development and blocking threats proactively, the MetaSleuth platform for fund tracking and investigation, and MetaSuites extension for web3 builders surfing efficiently in the crypto world.

To date, the company has served over 300 esteemed clients such as MetaMask, Uniswap Foundation, Compound, Forta, and PancakeSwap, and received tens of millions of US dollars in two rounds of financing from preeminent investors, including Matrix Partners, Vitalbridge Capital, and Fenbushi Capital.

Official website: https://blocksec.com/

Official Twitter account: https://twitter.com/BlockSecTeam

Sign up for the latest updates
The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.