solana-cpi-safetylisted

# Solana CPI Safety This skill covers four classes of cross-program invocation vulnerability in Solana programs. The novel core is CPI return-data spoofing: trusting `get_return_data()` without verifying the producing program is an under-documented attack surface that allows a malicious CPI callee to inject arbitrary return data into the caller's control flow. The remaining three classes — arbitrary CPI, stale account reads after CPI, and non-canonical PDA signing — are included for completeness, each with a runnable proof-of-concept harness. ## What This Skill Is For Use this skill when you are: - Working with Solana cross-program invocations — `invoke`, `invoke_signed`, or Anchor's `CpiContext::new` / `CpiContext::new_with_signer` - Reading CPI return data with `get_return_data()` or the `sol_get_return_data` syscall - Invoking a program whose address comes from a caller-supplied account (arbitrary CPI exposure) - Auditing or writing Anchor programs, native programs, or Pinocchio programs that cross program boundaries - Reviewing how your program handles account state after a CPI returns - Running a structured CPI security audit against a program or PR ## Task Routing Guide | When you are... | Read | |----------------|------| | Trusting CPI return data / using `get_return_data` without verifying the producer | [cpi-return-data-spoofing.md](cpi-return-data-spoofing.md) | | CPIing a caller-supplied program / program substitution / fake-SPL attack | [arbitrary-cpi.md](ar