FORK_ANCESTRY Skill (Solana)

Trigger Pattern: Always (run during recon TASK 0, not breadth) Inject Into: Recon agent only (meta_buffer.md enrichment) Finding prefix: [FA-N] Purpose: Detect known parent Solana programs and inherit their historical vulnerability patterns.

1. Detect Fork Indicators

Grep the codebase for known parent Solana program signatures:

Also check:

• Cargo.toml dependencies for parent crate names (e.g., marinade-sdk, jupiter-sdk, whirlpool-cpi)
• Import paths in Rust source: use marinade_finance::, use drift::, etc.
• IDL files for instruction/account names matching parent programs
• Anchor version in Cargo.toml (anchor-lang = "X.Y.Z") - known vulnerabilities per version

Git-based detection (complements code-pattern matching — catches forks that renamed all identifiers). Skip if REPO_SHAPE: squashed_import in build_status.md — single-commit repos have no meaningful git metadata.

• Parse .gitmodules for submodule URLs pointing to known parent repos
• Check git remote -v for origin URLs matching known Solana parent organizations (solana-labs, project-serum, marinade-finance, drift-labs, jito-foundation, orca-so, raydium-io, metaplex-foundation)
• If a git-URL match is found but NO code-pattern match exists, flag as GIT_ONLY_FORK

Output: List of detected parents with confidence level:

• HIGH: 3+ unique patterns matched, OR parent crate in Cargo.toml dependencies
• MEDIUM: 2 patterns matched
• LOW: 1 pattern matched (may be coincidental naming)
• GIT_ONLY: git URL match but no code patterns — fork likely renamed identifiers

2. Query Known Parent Issues

For each detected parent (confidence MEDIUM or HIGH):

2a. Solodit Search (two queries, run in parallel)

// Query 1: Known high-quality issues
search_solodit_live(
  keywords="{parent_name} solana",
  impact=["HIGH", "CRITICAL"],
  language="Rust",
  quality_score=3,
  sort_by="Quality",
  max_results=15
)
// Query 2: Fork-specific divergence issues
search_solodit_live(
  keywords="{parent_name} fork modified anchor",
  impact=["HIGH", "MEDIUM"],
  language="Rust",
  sort_by="Rarity",
  max_results=10
)

2b. Tavily Search

tavily_search(query="{parent_name} solana program vulnerability exploit audit finding 2024 2025 2026")

2c. Known Issue Catalog

Compile results into:

Applicability criteria:

• YES: Fork retains the vulnerable code path unchanged
• NO: Fork modified the vulnerable code path (document what changed)
• CHECK: Cannot determine without deeper analysis (flag for breadth agent)

2d. Hardcoded Known-Issue Floor (Web Search Fallback)

If Solodit AND Tavily BOTH fail, use this minimum catalog - check EACH applicable parent:

3. Divergence Analysis

For each detected parent:

3a. Identify What Changed

Compare fork vs parent in security-critical paths:

Solana-specific divergence focus areas (ordered by criticality):

Account Validation Changes (HIGHEST PRIORITY)

• Did the fork add or remove account constraints (has_one, constraint, seeds, owner)?
• Did the fork switch between Account<T> (auto-validated) and UncheckedAccount (manual validation)?
• Did the fork change signer requirements on any instruction?
• Missing owner/type/signer checks are the #1 Solana vulnerability class.

CPI Target Changes

• Did the fork change which programs are called via CPI?
• Are new CPI targets validated with program ID checks?
• Did the fork add CPI calls to programs not in the parent? (New external dependency = new attack surface)
• Critical: CPI without program ID validation = attacker can substitute a malicious program.

PDA Seed Changes

• Did the fork modify PDA seed schemas (different seeds, different order, added/removed seeds)?
• Changed seeds can cause: PDA collision (two different logical entities map to same address), PDA inaccessibility (legitimate accounts unreachable with new seeds), authority bypass (PDA used as signer with different derivation).
• Check: are seed derivations consistent between creation and usage across all instructions?

Token-2022 Additions

• Did the fork add Token-2022 (spl_token_2022) support where parent used SPL Token only?
• Extension handling is complex: transfer hooks, transfer fees, confidential transfers, permanent delegate.
• Check: does the fork handle ALL extensions the token might have? Or only a subset?
• Critical: Transfer hook extensions can execute arbitrary code during transfers.

Other Divergence Areas

• Modified mathematical formulas (fee calculations, exchange rates, reward distribution)
• Parameter semantic verification: When the parent has a mathematical specification, verify that each core parameter carries the same mathematical meaning in the fork — not just the same name and numeric range. Forks may store a raw value where the parent stores a derived form (e.g., raw coefficient vs. coefficient scaled by a function of pool dimensions). Compare the fork's formula usage against the parent's specification to confirm the encoding convention matches.
• Changed access control (added/removed authorities, modified role hierarchy)
• Removed safety checks (validation removed, constraint removed)
• Changed account data layouts (fields reordered, types changed, sizes changed)
• Added/removed instructions (new attack surface or missing safety instructions)

3b. New Attack Surface from Divergence

For each modification:

• Does the change introduce a NEW vulnerability not in the parent?
• Does the change REMOVE a parent fix/mitigation?
• Does the change create an INCONSISTENCY with parent's invariants?
• Does the change break assumptions that other unchanged code relies on? (e.g., parent assumes PDA X always exists; fork adds ability to close PDA X)

4. Output to meta_buffer.md

Append to {SCRATCHPAD}/meta_buffer.md:

## Fork Ancestry Analysis

### Detected Parents
| Parent | Confidence | Patterns Found | Anchor Version |
|--------|-----------|---------------|----------------|

### Inherited Vulnerabilities to Verify
| # | Parent Issue | Severity | Location in Fork | Status |
|---|-------------|----------|------------------|--------|
| 1 | {issue} | {severity} | {fork location: file:line} | CHECK / VERIFIED_SAFE / VULNERABLE |

### Fork Divergences (Security-Critical)
| # | Component | Change Type | Change Description | New Risk? |
|---|-----------|------------|-------------------|-----------|
| 1 | {component} | ACCOUNT_VALIDATION / CPI_TARGET / PDA_SEED / TOKEN_2022 / OTHER | {what changed} | YES/NO/CHECK |

### Anchor Version Vulnerabilities
| Version | Known Issue | Applicable? |
|---------|-----------|-------------|
| {version from Cargo.toml} | {known issue for this version} | YES/NO |

### Questions for Breadth Agents
1. {derived from inherited vulnerabilities}
2. {derived from divergence analysis}
3. {derived from CPI target changes}

Step Execution Checklist (MANDATORY)

Cross-Reference Markers

After Step 1: If Anchor version detected -> check against known Anchor version vulnerabilities immediately.

After Step 3a (Account Validation): Feed changed/removed constraints to ACCOUNT_VALIDATION skill for targeted re-analysis.

After Step 3a (CPI Target): Feed new CPI targets to CPI_SECURITY skill for program ID validation audit.

After Step 3a (PDA Seed): Feed changed seeds to PDA_SECURITY skill for collision/derivation audit.