The attacker does not need an exploit. He needs you to do nothing. Solana cut slot time from 400 ms to 200 ms on Oct 9. Alpenglow activates tomorrow and changes how the block timestamp is set. If your program measures time in slots, every timelock, vesting cliff, cooldown and oracle window is now half as long. No error, no failed test. Auditor Dog v7.5 was released today and checks for this. It is the open-source AI security auditor in the official Solana Brasil GitHub (60 stars, MIT). KV-138 plus nine checks across governance, economics, backend and tests. Run it on your repo today. What is already broken: A 432,000-slot "48 hour" governance timelock is 24 hours. BonkDAO lost $20M in July to a proposal nobody read in time. - Vesting in slots: cliffs arrive early. - TWAP and staleness windows in slots: manipulation costs half. - Lending programs with SLOTS_PER_YEAR = 63,072,000 charge 2.5x the configured APR. Save hardcodes that literal. Mango v4 multiplies staleness by 450 ms. Drift's guard rail says 120 slots "~60 seconds". It is 24. What breaks tomorrow: the leader sets the block timestamp inside a bounded range. Auction close, expiry, liquidation grace: any gate at an exact second is his call. The EVM had this at the Merge. Compound hardcoded 2,102,400 blocks a year, a BSC fork charged 5x, and "block number as a clock" became a standard audit item. Kudos to @KaminoFinance who shipped time-based accrual on Aug 18, before the first cut.

Why IMO Auditor Dog is a thing? 1 - When you talk about audits, you have blind spots between audits. Why? A new commit is needed, maybe a fix that can't wait goes without any audit. 2 - Auditor Dog can attest that, at that snapshot, the program/repo/site was tested against all listed items available in that corpus (it's open source, 100% transparent). 3 - So if a program or repo has undergone a full audit and gets the attestation written on-chain, and then 1 month later needs to update 20 lines, maybe to add a feature or change a small thing, it can run the diff against the corpus and keep the attestation live. So no more blind spots, but a new standard of audit attestations that comes to make program audits not just pictures, but 100% live. Any new change, a new attestation, and users know EXACTLY what it was tested against. As it uses agents, we are not here to substitute traditional auditors, but we are here to be another layer of safety. As it is open source, we hope people join me and contribute to the official Solana Brasil @SuperteamBR repo. Let's cover all spots. As an example, I used an OLD STREAMFLOW PROGRAM (OUTDATED) to show what it can find. And a live Meteora presale program showing that no findings were found.

We are in the Colosseum hackathon with Auditor Dog: free security audits for Solana programs, run on your own model key, recorded on-chain. It started with a bug. In June my open-source auditor found a live fee-theft bug in Meteora's Dynamic Fee Sharing: any shareholder of a fee vault could take 100% of one token side of every fee claim. 2,860 vaults exposed. I wrote a PoC on a fork of the deployed binaries, reported it through the bounty, showed the shipped fix did not close it, and got paid. Bug, PoC, report, payment. So why is this not available to everyone? I know the pain. Building Defunds Finance, the audit was the slowest, most expensive and least transparent step, and it was stale after the next commit. Most Solana code ships with no audit at all. Now agents write a big share of the new code, and nobody reads it. The engine is auditor-skill, open source, MIT: 20 checklists, 1,413 items, 136 real-world attack vectors, a Rust pre-scanner, PoC and patch commands. 58 stars, 13 forks. Open on purpose. Audit knowledge gets better when the community adds attack vectors as exploits happen, not when it stays locked inside firms. Auditor Dog turns it into a public pipeline. Paste a GitHub link, get a cost ceiling, paste a spend-limited API key (checked, encrypted, wiped before the model starts). A fresh machine audits that exact commit with read-only tools. 15 to 25 minutes later the full report is published byte-for-byte, and one account is written on Solana for that repo and commit: report hash, corpus version, model, severity counts. Anyone can derive the address and verify it. No wallet, no fees, no key custody. You pay for tokens, nothing to us. Not a demo. 39 real audits of 29 repositories across 24 Solana orgs are already on the site: Kamino, Meteora, Lido, Serum, Saber, Streamflow, Flash Trade and more. 4 Critical, 8 High, all public, no redaction. About $205 in tokens for the whole set. The audit stays free. The paid product is continuous attestation: every new commit gets a delta audit and a new on-chain record, paid by the protocol that owns the repo. A living audit instead of a stale PDF. If you maintain a Solana program, paste it in and tell me what the report gets wrong. That is how the corpus gets better. Built with my co-founder @mvgp_td. @colosseum @SuperteamBR