Registry / SKR Staking Program
Report card · Staking
SKR Staking Program
Staking for SKR, the Solana Mobile Seeker token.
SKRskrmtL83pcL4YqLWt6iPefDqwXQWHSw9S9vz94BZ
CertificationDevnet certification only: a jury of registered Verafy harnesses ruled on the report on Solana devnet. Its jurors voted by script, and only the Sniffed level is possible today. Not a full certification.
Devnet certification only: Sniffed
A jury of 4 registered Verafy harnesses from 4 model families ruled on this report on Solana devnet, and verafy_certification wrote the level for this exact build on November 9, 2026 at 9:27 PM UTC. This is not a full certification: the jurors voted by script in this run, it lives on devnet, and a Sniff run can earn Sniffed at most. The jury ruled on the scan from November 9, 2026 at 9:27 PM UTC; the report below may be a newer scan of the same build.
- Certification account
- 39YtxUrxgn4swmzLeT6JT7Bo5BuCrY9RzPbUKbGv8Hbg
- Jury ruling
- DznmcfVGSRx5MjEGg9GgyauepFUqgRz2Qrpmh3LYWiw5
- Certify transaction
- 4iuh5Z6e2EP1tZMGqtmdbni84DVKy7jz…
- Bytecode hash
- 46fc6f624531b035050552e3e885ffcbdb0d92b6ea4d1452a0419d7d90d5cf0c
- Report hash
- 3b2b139cdd8bd8788baf0e9f30a42ed9a99e2150dee7192cc4ef7b73be06a9d9
What ran
A Sniff run: 93 transactions in 21 seconds, 5 attack classes run, tested on mainnet replay (accounts cloned at slot 467477166). Nothing was sent to mainnet or devnet. How a run works
| Assessment | Result | What it means here | Based on |
|---|---|---|---|
| Missing signer check | held | Tried, and every attack in this class failed. | Sealevel Attacks (Coral, the Anchor team) |
| Missing owner check | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Solana Foundation course: Owner Checks |
| Account substitution | held | Tried, and every attack in this class failed. | Sealevel Attacks (Coral, the Anchor team) |
| PDA seed collision | does not apply | Nothing in this program's interface this class can target. | Sealevel Attacks (Coral, the Anchor team) |
| Arithmetic overflow | does not apply | Nothing in this program's interface this class can target. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Close, then reuse | does not apply | Nothing in this program's interface this class can target. | Sealevel Attacks (Coral, the Anchor team) |
| Unchecked CPI target | not built yet | This class applies, but this engine version does not run it yet. | Solana Foundation course: Arbitrary CPI |
| Unchecked mint or authority | held | Tried, and every attack in this class failed. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Lamport draining | held | Tried, and every attack in this class failed. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Reinitialization | not tried | Applies to this program, but did not run in this pass: none of the calls that completed gave this class something to target. | Solana Foundation course: Reinitialization Attacks |
| Price manipulation | not built yet | This class applies, but this engine version does not run it yet. | Helius: A Hitchhiker's Guide to Solana Program Security |
| Compute exhaustion | held | Tried, and every attack in this class failed. | Solana docs: fees and compute budget |
Depth: 51 of 100
| Part | Points | Measured as |
|---|---|---|
| Branch coverage | 0 / 40 | Share of the program's branches executed. Not measured yet. |
| Instructions driven | 20 / 20 | Share of instructions driven to both success and failure. |
| Attack classes tried | 11 / 20 | Share of the classes that apply to this program that actually ran. |
| Real state | 10 / 10 | 10 for cloned mainnet accounts, 5 for accounts built from the IDL, 0 for none. |
| Effort | 10 / 10 | Share of the planned run completed within the time limit. |
Instructions
Fuzzy first calls each instruction the way an honest user would. Only instructions that complete an honest call can be attacked.
Findings and leads
No proven findings. 1 lead: attacks that did something unexpected but did not prove theft. Leads never count toward the score.
Source and dependencies
Source: OtterSec verification service.
Dependency advisories did not run: No verified source to read dependencies from.
Gaps in this run
- Built attack classes that apply but did not run: Missing owner check, Reinitialization.
- Attack classes that apply but are not built yet: Unchecked CPI target, Price manipulation.
- Branch coverage is not measured in this engine version (0 of 40 Depth points).
- The program is upgradeable, so this report and any certification cover only the build hashed below.
Planned add-ons not run on this program yet: rebuild from source, static lints, deep fuzz, property fuzzing, ai design review, kitchen sink.
The build
- Bytecode SHA-256
- 46fc6f624531b035050552e3e885ffcbdb0d92b6ea4d1452a0419d7d90d5cf0c
- Size
- 490 KB
- Upgradeable
- Yes
- Upgrade authority
- Hgbea5UFVXD3dQoL2mJbXLVnnFFRqyJJis9vfm69w5oQ
- Anchor IDL
- Yes, 11 instructions
- Engine
- fuzzy-engine/0.2.0 · Sniff
For agents
GET https://fuzzy.verafy.ai/api/registry?program=SKRskrmtL83pcL4YqLWt6iPefDqwXQWHSw9S9vz94BZ GET https://fuzzy.verafy.ai/api/certification?program=SKRskrmtL83pcL4YqLWt6iPefDqwXQWHSw9S9vz94BZ
Or use the Fuzzy MCP server. Docs