# Solana Incident Response

> Solana security incident response and war-room coordination. Use the moment a live or suspected exploit, drained treasury, compromised key, malicious upgrade, or failing-in-prod program is in play. Routes the responder through the five IR phases — DETECT, CONTAIN, INVESTIGATE, TRACE, RECOVER — plus stakeholder coordination (SEAL 911, SIRN), forensic replay (Surfpool fork), on-chain fund tracing, whitehat/Safe Harbor negotiation, and post-mortem + disclosure drafting. For writing/auditing program code use solana-auditor / trailofbits / safe-solana-builder; this skill is for the response, not the audit.

- Skill: `mihailshumilov/solana-incident-response` (Agent Skill, multi-file: 11 files)
- Install (CLI): `npx skillmds@latest add mihailshumilov/solana-incident-response`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mihailshumilov/solana-incident-response/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: mihailShumilov (https://skillmd.com/u/mihailshumilov)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mihailshumilov/solana-incident-response

---


# Solana Incident Response Skill

> **The minutes after an exploit decide how much you keep.** This skill turns a panicking founder or on-call engineer into an organized incident commander with a phase-by-phase runbook, the right contacts, and the right on-chain moves — fast, reversible-by-default, and human-gated on anything destructive.

> ⚠️ **Operational support, not legal advice and not a guarantee of recovery.** This skill helps you respond faster and more correctly. It does not replace SEAL 911, your security firm, or counsel. Every fund-moving or program-changing action requires explicit human authority-holder approval. See [DISCLAIMER.md](../DISCLAIMER.md).

## When To Use This Skill

Trigger on any of:

- **Active exploit** — TVL is draining, unexpected withdrawals, a program is being abused right now.
- **Suspected compromise** — a signer key, deployer, multisig member, or CI/CD pipeline may be compromised; pre-signed transactions may exist.
- **Malicious or mistaken upgrade** — an unexpected program upgrade, authority transfer, or config change landed.
- **Drained treasury / wallet** — project funds, vesting, or a user's wallet moved without authorization.
- **Failing in prod** — a critical instruction is reverting or misbehaving on mainnet and may be exploitable.
- **Pre-incident readiness** — "build us an incident runbook", "set up a war-room plan", "run an IR drill".

If the user is writing new program code or wants a *code audit*, route to the auditor/security skills instead. This skill starts where the audit ended: something is wrong **in production, now**.

## First Move (read this before anything else)

When an incident is reported, do these in order and do not skip:

1. **Stabilize the human.** State the plan in one line: *"We'll contain, then investigate, then trace — I'll gate every irreversible step on your approval."*
2. **Open SEAL 911 in parallel.** It is free, 24/7, and staffed by vetted responders who can pull in exchanges and other protocols. Telegram: **@seal_911_bot** / see [resources.md](resources.md). Do this even if you think you can handle it — it costs nothing and starts the freeze clock.
3. **Classify the incident** (see table below) — this picks your containment path.
4. **Start the war-room log.** Every action, timestamp, tx signature, and decision goes in one append-only doc (template: [war-room-roster.md](../templates/war-room-roster.md)). This is your post-mortem and your legal record.
5. **Do NOT** broadcast publicly yet, do NOT interact with the attacker, do NOT push an untested fix to mainnet. Containment first.

## Classify The Incident → Pick The Path

| Symptom | Likely class | Go to |
|---|---|---|
| Funds leaving via a program instruction | Smart-contract exploit | [contain.md](contain.md) → pause/upgrade |
| Unexpected upgrade / authority change | Key or pipeline compromise | [contain.md](contain.md) → revoke/rotate |
| Multisig approved something nobody recognizes | Social-engineering / pre-signed tx | [contain.md](contain.md) → multisig lockdown |
| One wallet drained, programs fine | Private-key / seed leak | [trace-funds.md](trace-funds.md) + SEAL 911 |
| Token mint/supply anomaly | Mint authority abuse | [contain.md](contain.md) → freeze/mint-authority |
| Program reverts / misbehaves in prod | Bug, possibly exploitable | [investigate.md](investigate.md) → replay first |
| Autonomous agent manipulated / halted / draining | Agent-specific failure | [agent-incidents.md](agent-incidents.md) |
| Not sure yet | Unknown | [detect.md](detect.md) → confirm scope |

> **2026 reality check:** the largest recent Solana loss — the **~$286M Drift exploit (April 2026)** — did *not* break the smart contract. It used social engineering to get pre-signed multisig transactions (via durable nonces) that stayed valid for over a week. If keys/process may be compromised, treat **multisig and pending transactions as hostile**, not just the program. (See [coordinate.md](coordinate.md) and [resources.md](resources.md).)

## The Five Phases (Progressive Disclosure — load only what you need)

### 1. DETECT — confirm, scope, and freeze the timeline → [detect.md](detect.md)
Confirm it's real (not an RPC glitch), establish blast radius, identify affected programs/accounts/tokens, set up live monitoring on the attacker address (Helius webhooks), and snapshot state before it changes.

### 2. CONTAIN — stop the bleeding, reversibly where possible → [contain.md](contain.md)
Pause guardians, emergency-admin instructions, upgrade-authority moves, mint/freeze-authority actions, multisig lockdown, revoking pending/pre-signed transactions, and circuit-breaker patterns. **Every action here is authority-gated and logged.**

### 3. INVESTIGATE — root cause without touching mainnet → [investigate.md](investigate.md)
Fork mainnet with **Surfpool**, replay the exploit transaction at the exact slot, profile compute units and account diffs, isolate the vulnerable instruction, and confirm the fix on the fork before any redeploy.

### 4. TRACE — follow and freeze the funds → [trace-funds.md](trace-funds.md)
Map outflows with Helius Enhanced Transactions, label hops with Arkham / MistTrack / Range, identify CEX deposit and bridge addresses, and push freeze requests through SEAL 911 and exchange security contacts within the 72-hour window.

### 5. RECOVER — restore service and make users whole → [recover.md](recover.md)
Whitehat/Safe Harbor negotiation, recovery-address handling, patched redeploy, treasury reseed, reimbursement mechanics, and the decision tree for resume-vs-stay-down.

### Cross-cutting: COORDINATE → [coordinate.md](coordinate.md)
SEAL 911, SIRN, STRIDE, Immunefi, exchanges, validators, and counsel — who to call, in what order, and what to tell them. Includes the **Safe Harbor** rules of engagement for whitehats.

### Cross-cutting: DISCLOSE → [disclose.md](disclose.md)
Holding statement → user comms → full post-mortem → regulator/counsel notes. Templates included. Never publish details that re-enable the exploit while funds are still at risk.

### Distinct surface: AGENT INCIDENTS → [agent-incidents.md](agent-incidents.md)
Autonomous AI agents fail differently — prompt injection, key compromise, silent halt/liveness, MEV bleed, oracle deviation, protocol contagion — and need **deterministic tripwires**, not just human alerts. Includes the agent failure-mode table, a machine-checkable trigger taxonomy that feeds DETECT, pre-deployment risk scoring, and risk-transfer/coverage options.

### Before it happens: PREPARE → [preparedness.md](preparedness.md)
Build the runbook, define authority-holders and a war-room roster, wire monitoring, pre-sign Safe Harbor, and run tabletop drills (`/ir-drill`).

## Pick The Right Agent

| Situation | Agent | Model |
|---|---|---|
| Running the whole incident, decisions & sequencing | **incident-commander** | opus |
| Replaying the exploit, tracing funds, forensics | **forensics-analyst** | opus |
| Holding statements, post-mortems, user/regulator comms | **comms-officer** | sonnet |

## Commands

| Command | Purpose |
|---|---|
| `/ir-triage <tx sig \| symptom>` | Classify the incident and produce the first-15-minutes action list |
| `/ir-contain` | Generate the authority-gated containment plan for the classified incident |
| `/ir-trace <address>` | Build the fund-flow map and freeze-request package |
| `/ir-postmortem` | Draft the post-mortem from the war-room log |
| `/ir-drill` | Run a tabletop exercise against a chosen scenario |

## Safety Rails (always on — see [rules/incident-response.md](../rules/incident-response.md))

- **Read-only by default.** This skill investigates and *proposes*; it never signs, sends, or upgrades on its own.
- **Human gate on irreversibility.** Pausing, upgrading, transferring authority, freezing, or moving funds requires an explicit named authority-holder to approve and execute.
- **No attacker contact** without an agreed strategy (usually via SEAL 911 / counsel).
- **Preserve evidence.** Snapshot before you change state; log every action with timestamps and signatures.
- **Devnet/fork first.** Any fix is reproduced and verified on a Surfpool fork before mainnet.

## Relationship To The Rest Of The Kit

This skill **does not duplicate** the kit's audit/security stack — it consumes it:

- Vulnerability *classes* and code-level checks → `ext/trailofbits`, `ext/safe-solana-builder`, `ext/ghostsecurity`, `ext/qedgen` (formal verification).
- Forked-state replay primitive → **Surfpool MCP** (already in the kit) and `/debug-user-tx`.
- On-chain data → **Helius MCP** (already in the kit).
- Legal/regulatory follow-through → `crypto-legal-skill`.

This skill is the **playbook and coordination layer** that orchestrates those during a live crisis — the piece the kit is missing.