Relay

Relay is a proxy program designed to route cross-program invocations to a set of approved target programs. It takes a program ID and instruction data from the caller, validates against a whitelist, and forwards the call.

The architecture looks solid, but the validation has a gap. If you can find it, you can route calls to programs that were never meant to be reachable.

CPI-based architectures are increasingly common in Solana — routers, aggregators, and intent-based protocols all rely on forwarding calls. When a program invokes another program with its own authority, the trust boundary is critical.

This is an advanced challenge that requires understanding CPI mechanics and program ID validation.