---
stable_id: skills/skills-sh-trailofbits-skills-solana-vulnerability-scanner
type: skills
title: skills-sh-trailofbits-skills-solana-vulnerability-scanner
summary: >-
  ### 6.1 ARBITRARY CPI (Cross-Program Invocation) ⚠️ CRITICAL

  **Description**: Using `invoke()` or `invoke_signed()` with user-controlled
  program IDs allows attackers to call malicious programs instead of the
  intended program.

  **Detection Patterns**:

  ```rust

  // VULNERABLE: User-provided program ID without validation

  pub fn transfer_tokens(
      ctx: Context<TransferTokens>,
      amount: u64,
  ) -> Result<()> {
      // User provides token_program account
tags:
  - skills-sh
  - skills-sh-all-time
source_url: https://raw.githubusercontent.com/trailofbits/skills/HEAD/plugins/building-secure-contracts/skills/solana-vulnerability-scanner/resources/VULNERABILITY_PATTERNS.md
license: ""
upstream_ref: https://skills.sh/trailofbits/skills/solana-vulnerability-scanner
github_stars: null
github_forks: null
github_is_organization: null
retrieved_at: 2026-06-11T08:32:54.834Z
content_sha256: 15e16aaf36eb2d8edad7586dd59968723327798848ee966baa6fef5edb2abb7e
---
