Writing
2026
- The Avici exploit: Ed25519 instructions are pointers, not inline data
How the Avici hack exploited Rain's Ed25519 parsing: why Solana's verifier follows instruction indices, and what programs must check before treating a signature as admin authorization.
- Three ways to CPI in Solana (and when to use each)
How to make a cross-program invocation (CPI) in Anchor: helper crates, declare_program!, or bare metal, when to use each, plus Meteora and Jupiter examples.
- Starting this blog
A short note on what this blog is for: concrete, code-first writing about Solana smart contract development.