As the blockchain world expands, Solana has stepped into the spotlight as a compelling alternative to Ethereum. But behind its lightning-fast transactions and low fees lies a hidden world of unique security challenges.

One such vulnerability that we frequently encounter during our security audits on the Solana blockchain is known as the “Revival Attack“. This post will dive deep into how these attacks work, their impact, and how to prevent them.

Let’s look at a vulnerable implementation of an account closure:

This code appears to close the account by removing its lamports, but it has a critical flaw: the account can be “revived” within the same transaction. An attacker could send a transaction with these 2 instructions:

• Call to close_account
• Transfer lamports to account_to_close

At the end of the transaction account_to_close will still be “rent-exempt” so it will not be deleted by the garbage collector.

Example: Staking Vault Exploitation

To illustrate how a Revival Attack might work in a Solana protocol, let’s consider a staking vault program. This program allows users to deposit their tokens into a vault, which would then be staked on their behalf.

Users could then redeem their staked tokens, along with any rewards earned, by calling a redeemStakedTokens instruction.

Here’s a simplified version of the vulnerable redeemStakedTokens instruction:

By transferring out lamports from the user_stake PDA, the protocol expects it to be deleted at the end of the end of the transaction. It can actually be revived and reused!

An attacker could exploit this vulnerability using the following transaction structure:

By bundling these instructions in a single transaction, the attacker can:

1. Redeem their staked tokens and rewards
2. Prevent the stake account from being garbage collected by refunding it
3. Repeat the process multiple times, effectively draining the staking pool

The impacts of Revival Attacks can be severe:

• Multiple redemption of one-time rewards
• Bypass of critical business logic
• DOS of the protocol by putting an account in an unusable state

To properly close accounts and prevent Revival Attacks, implement all three of these measures:

1. Zero out the account data:

2.   Set a closed account discriminator:

All functions that should not support an account being revived should then check that imputed accounts discriminators.

3.   Transfer out all lamports:

If you’re using the Anchor framework, you can use the close constraint, which handles all these steps automatically:

Additional Considerations

While you can’t prevent an attacker from refunding an account with lamports, proper implementation of all three closure steps ensures that:

1. The account data is wiped, preventing reuse of old state
2. The closed discriminator prevents the program from accepting the account in future transactions
3. You program should be exploit-proof at this stage but users could still put some accounts in a state that is not usable but not garbage collected at the same time. If that’s something you do not want in your program, Solana course book recommends to implement a Manual Force Defund function.

Revival Attacks represent a subtle but significant vulnerability in Solana programs. As security researchers at FuzzingLabs, we’ve seen this pattern repeatedly in bug bounty programs. Always implement proper account closure mechanisms, preferably using Anchor’s close constraint.

Remember: in blockchain security, the smallest oversight in account management can lead to significant exploits. Always thorough test your account closure logic, and consider how your program handles closed accounts that maintain their rent-exempt status.

https://solana.com/developers/courses/program-security/closing-accounts

Mathieu Troullier / Patrick Ventuzelo

Founded in 2021 and headquartered in Paris, FuzzingLabs is a cybersecurity startup specializing in vulnerability research, fuzzing, and blockchain security. We combine cutting-edge research with hands-on expertise to secure some of the most critical components in the blockchain ecosystem.

Contact us for an audit or long term partnership!

Get Your Free Security Quote!

Let’s work together to ensure your peace of mind.