Vaultz

Vaultz is a basic SOL vault built with Anchor. Users can deposit into a shared vault and later withdraw their funds. The program compiles, tests pass, and everything looks clean at first glance.

But there's a subtle oversight in one of the instructions. Your job is to find it, understand the impact, and write a clear report.

Vault programs are among the most common building blocks in Solana DeFi. They hold user funds and expose deposit/withdraw interfaces. Even small mistakes in how these instructions validate callers can have catastrophic consequences.

This is a good starting point if you're new to Solana security research.