Objective: Build a clear, educational security reference for Solana developers by contrasting vulnerable code with secure alternatives.

Deliverable: A public repository containing at least 5 Solana programs where each example contains a deliberately broken instruction and a corresponding fixed version, with comments explaining what went wrong and how it was corrected.

Content to include: Each example must include: a vulnerable instruction; a secure version of the same instruction; clear inline comments explaining the issue and the fix.

Additional requirements: Code must be fully open source; a deep-dive content piece explaining the security patterns (video or written); build solo or with a team of up to 4 people; the winning submission will be pushed to the SuperteamNG repository.

Technical expectations: demonstrate solid understanding of Solana’s account model; correct use of Anchor constraints and checks; awareness of CPI and re-entrancy risks; safe handling of arithmetic and state mutation; clear reasoning, not just code changes.

Tech stack: You may use Anchor, Pinocchio, or both; tests encouraged but not mandatory.

<h2 class="heading-node">Overview</h2>Security remains one of the biggest challenges in Solana program development. Many exploits do not come from complex attacks, but from simple mistakes: missing account validation, incorrect authority checks, unsafe arithmetic, or misunderstood CPI behavior.Anchor and Pinocchio provide strong abstractions, but they do not automatically make programs safe. Developers still need to understand why a pattern is dangerous and how to fix it correctly.This bounty focuses on building a clear, educational security reference for Solana developers by contrasting vulnerable code with secure alternatives. The goal is to make security concepts practical and obvious, especially for developers learning Anchor or Pinocchio.You will create a repository of at least 5 Solana programs where each example contains a deliberately broken instruction and a corresponding fixed version, with comments explaining what went wrong and how it was corrected.<h3 class="heading-node">Requirements</h3>Your submission must include:<ul class="list-node"><li>A public repository containing multiple security examples</li><li>Each example must include:<ul class="list-node"><li>A vulnerable instruction</li><li>A secure version of the same instruction</li><li>Clear inline comments explaining the issue and the fix</li></ul></li></ul><h3 class="heading-node">Additional requirements:</h3><ul class="list-node"><li>Code must be fully open source</li><li>A deep-dive content piece explaining the security patterns (video or written)</li><li>Build solo or with a team of up to 4 people</li><li>The winning submission will be pushed to the SuperteamNG repository</li></ul><h3 class="heading-node">What You Can Build</h3>This bounty is about clarity, not scale. Small, focused examples are encouraged.Possible structures include:Side-by-Side Program Examples<ul class="list-node"><li>One instruction labeled “vulnerable”</li><li>One instruction labeled “secure”</li><li>Same business logic, different security handling</li></ul>Pattern-Based Modules<ul class="list-node"><li>A folder per vulnerability type</li><li>Each folder contains multiple small examples</li><li>Shared README explaining the pattern</li></ul><h3 class="heading-node">Technical Expectations</h3>Your submission should demonstrate:<ul class="list-node"><li>Solid understanding of Solana’s account model</li><li>Correct use of Anchor constraints and checks</li><li>Awareness of CPI and re-entrancy risks</li><li>Safe handling of arithmetic and state mutation</li><li>Clear reasoning, not just code changes</li></ul>This is an educational bounty. Readability and explanation matter as much as correctness.<h3 class="heading-node">Tech Stack Suggestions</h3>You may use Anchor, Pinocchio, or both.Tests are encouraged but not mandatory.<h3 class="heading-node">Judging Criteria</h3>Submissions will be evaluated based on:<ul class="list-node"><li>Accuracy of vulnerability examples</li><li>Quality of explanations and comments</li><li>Coverage of real-world Solana attack patterns</li><li>Code clarity and organization</li><li>Usefulness as a learning resource</li></ul>Bonus points for:<ul class="list-node"><li>Tests that demonstrate the exploit and the fix</li><li>Clear README summaries per vulnerability</li><li>Clean comparison between Anchor and Pinocchio approaches</li></ul><h3 class="heading-node">Prizes</h3>A total prize pool of $4,000 USDC will be distributed among the top submissions:<ul class="list-node"><li>1st Place: 1,500 USDC</li><li>2nd Place: 1,000 USDC</li><li>3rd Place: 700 USDC</li><li>4th Place: 500 USDC</li><li>5th Place: 300 USDC</li></ul>ResourcesAnchor Documentation<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.anchor-lang.com/docs">https://www.anchor-lang.com/docs</a>Solana Documentation<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://solana.com/docs">https://solana.com/docs</a>Pinocchio Framework<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://github.com/anza-xyz/pinocchio">https://github.com/anza-xyz/pinocchio</a>Solana Account Model<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://solana.com/docs/core/accounts">https://solana.com/docs/core/accounts</a>

Intermediate Developer Challenge: Anchor/Pinocchio Security Template

Intermediate Developer Challenge: Anchor/Pinocchio Security Template