1. Incident Overview & Financial Impact

Recent on-chain incident responses on Solana revealed an evolving class of phishing dApps exploiting wallet transaction simulation vulnerabilities. By disguising asset sweeps within custom multi-instruction transactions, attackers induce victims into signing what appears to be an innocent airdrop claim or governance verification.

The attacker's payload executes a series of Cross-Program Invocations (CPI) that transfer native SOL and associated token accounts (ATAs) to a designated sweeper account. Across 120+ reported incidents over the past week, estimated losses exceed $1.4M in SOL, JUP, and USDC.

2. Technical Root Cause & Vulnerability Mechanism

The vulnerability stems from the discrepancy between static RPC transaction simulation (simulateTransaction) and dynamic on-chain runtime execution.

Simulation Evasion Techniques:

  1. Clock & Slot Conditionals: The contract queries Clock::get()?.slot or recent_blockhashes. If the slot or blockhash timestamp matches an RPC simulation state, the program returns Ok(()) without transferring funds.
  2. Account Meta Obfuscation: The transaction specifies the victim's token account as writable, but masks the destination address behind an ephemeral intermediate PDA (Program Derived Address).
  3. Compute Unit (CU) Starvation: In some variations, the attacker forces excessive compute consumption unless the caller matches the specific attacker EOA, causing third-party simulation tools to report an execution timeout rather than a drain.
// Vulnerable CPI Pattern in malicious on-chain program
pub fn execute_claim(ctx: Context<ClaimContext>) -> Result<()> {
    let clock = Clock::get()?;
    // Conditional evasion check
    if clock.unix_timestamp > ctx.accounts.authority.valid_after {
        anchor_spl::token::transfer(
            CpiContext::new(
                ctx.accounts.token_program.to_account_info(),
                anchor_spl::token::Transfer {
                    from: ctx.accounts.user_token_account.to_account_info(),
                    to: ctx.accounts.attacker_vault.to_account_info(),
                    authority: ctx.accounts.user_authority.to_account_info(),
                },
            ),
            ctx.accounts.user_token_account.amount,
        )?;
    }
    Ok(())
}

3. On-Chain Flow, Evidence & Remediation Checklist

Investigation Flow:

  1. Victim connects wallet to phishing domain claiming to offer an exclusive reward.
  2. The dApp generates a transaction bundling ComputeBudgetProgram instructions with an opaque contract invocation.
  3. Wallet displays "Estimated Balance Change: +0.00 SOL".
  4. Upon signature, the transaction lands in a Solana slot, triggering the CPI sweep.

Mitigation & Hardening Roadmap:

  • Use Dedicated Fee Estimators: Calculate required micro-lamports per CU using our Solana Compute Budget Estimator.
  • Enforce Program Whitelisting: Never approve transactions that pass your keypair as an authorized signer to unknown custom program IDs.
  • Revoke ATA Delegations: Periodically audit and close unused Associated Token Accounts and delegations using Solscan or Solana CLI.