Security bugs on Solana do not always come from obscure runtime behaviour or complicated cryptography.
Often, a program trusted the wrong account, accepted the wrong authority, or assumed that two pieces of state belonged together without proving it.
Arc 12 was about finding those assumptions before an attacker does.
Across Days 78–84, we audited our own code, tightened account validation, wrote transactions designed to break the program, used property-based testing and fuzzing to search for edge cases, and reproduced a real class of account-substitution exploit.
The rule running through the whole arc was simple:
