Fuzzy: Look Before You Leap

For most of Solana's history, the one deciding whether to trust a program was a person. They read the docs, asked around in a Discord, looked for an audit, and decided. Security tooling grew up around that person. Audit firms write PDFs. Fuzzers like Trident give a developer a framework to write attacks by hand. Scanners and newer AI reviewers read code and list the bugs they think might be there.

That world is changing. Agents now hold wallets, call programs and move money without a person reading anything first. An agent that wants to swap, lend or pay through a program it has never seen has nothing it can check. A website can say anything. An audit PDF describes some build, maybe not the one deployed today, and an agent cannot use it anyway.

Two things are missing. The first is proof: scanners produce long lists of possible issues, mostly false alarms. The second is a record an agent can read: tied to the exact code that is deployed, written by someone who can't simply vouch for themselves, and readable in one call.

Look before you leap

Fuzzy is a look-ahead for agents: a Solana fuzzer built by agents, for agents. It attacks, records and grades Solana programs, keeps a running grade for each one, and flags vulnerabilities before an agent ever sends money through a program.

An agent can use it three ways:

1. Look it up. Free and instant. If Fuzzy has already scanned or certified this exact build, the agent reads the registry or the certification account and has its answer without running anything.
2. Run Fuzzy first. For a program nobody has scanned, or a build that changed, the agent runs Fuzzy before it uses the program. It costs 100 Verafy credits, and the result goes into the registry for the next agent.
3. Get it certified. A jury of AI models checks the run and rules on a level, and the level is imprinted on chain for that exact build.

Scan a program

Paste a program address, or drop a compiled .so and its IDL, and press Run. A Sniff run costs 100 credits and takes under a minute.

One pass instead of five

Evaluating a Solana program has meant a handful of separate tools and steps, each run by a person who then puts the results together: confirm the deployed build, run a static scanner for known bug patterns, write a fuzz harness, test against real mainnet state, and commission an audit for a verdict others will trust.

Fuzzy runs the parts a machine can prove as one automated pass, in sequence:

• Ingest: fetch the deployed bytecode, hash it, read the IDL and the upgrade authority. Every result is tied to that hash.
• Learn: call every instruction the way an honest user would, to find the paths that work.
• Replay: replay the program's recent mainnet calls on cloned copies of the accounts they touched.
• Attack: drop required signatures, re-run setup as a stranger, swap in look-alike accounts owned by another program, push arguments to their limits.
• Prove: keep a finding only if the attack transaction succeeds and moves funds to the attacker or writes the attacker in as an authority. Everything else is a lead: shown, never scored.
• Grade: score the run.

It does not replace a human audit of a program's design and economics. It checks what can be proven by running transactions, and it does it every time, the same way.

On our benchmark vault, a program we wrote with two deliberate bugs, Fuzzy found both, chained one of them into a full drain, and scored it 20 out of 100. The fixed build of the same program came back with no findings.

The Fuzzy Score is the lower of two numbers: Depth, which says how hard Fuzzy tried, and a cap set by the worst proven bug. A shallow run can't score high because it found nothing, and a deep run can't score high while a critical bug exists.

Graded by an AI jury, imprinted on Verafy Devnet

A score from a tool is still just the tool's word. So the last two steps leave Fuzzy.

Verafy Devnet is where Verafy's programs run on Solana devnet. Juries of AI models from different labs, each running in a registered Verafy Harness, rule on questions and seal their rulings on chain, and you can watch every ruling and every vote.

Fuzzy sends the jury its report, hashed. The jurors check the run against the level rules and rule a level: Not certified, Sniffed, Fuzzed or Hardened. A small Solana program, verafy_certification, then imprints that level on devnet at an account derived from the program address and the hash of its exact bytecode. It refuses unless a sealed ruling backs it, with at least three registered jurors from at least two model families. Nobody can certify their own program by signing a transaction.

For an agent, checking a program is one read: hash the program's current bytecode, read one account. If the program is upgraded, the hash changes and the old certification no longer applies, so a certification never vouches for code it didn't test. The first certification is live on devnet today, for the fixed build of our benchmark vault. The jurors in that first run voted by script; real model jurors are next.

What Fuzzy runs, and where each check comes from

Each attack class Fuzzy runs is a class of Solana exploit that security researchers have documented: missing signer checks, missing owner checks, account substitution, unchecked token owners, reinitialization, arithmetic overflow, lamport draining and compute exhaustion. They come from catalogs like Coral's Sealevel Attacks, the Solana Foundation's program security course and Helius's guide to Solana program security. Four more are planned: unchecked CPI targets, PDA seed collisions, close-then-reuse and price manipulation. In mainnet replay, theft is measured in SPL tokens as well as SOL: the attacker gets empty token accounts of their own, so any token that lands there was taken from someone.

Deeper checks are add-ons, for more credits, chosen in one menu next to the Run button. Two run in seconds. The verified-source check (+25 credits) asks OtterSec's verification service whether the deployed bytecode was rebuilt from a public repository, and at which commit. Dependency advisories (+100) read that commit's Cargo.lock and check every crate against the RustSec advisory database. Only 9 of the 100 most-used programs have a verified build on record, which is a finding in itself.

The rest run on a build machine with the Rust and Solana toolchains: rebuilding from source and matching it byte for byte to the deployed program (+500), Trail of Bits' Solana lints and Clippy (+300), Deep Fuzz with measured branch coverage (+1,000), property fuzzing with invariants derived from the IDL (+1,500), and an AI design review by four models from different labs (+1,000). Kitchen Sink runs all of them for 4,000. They are built; the build machine is being connected now, and nothing is charged for a check that cannot run. The full list is on the Method page.

A registry of the most-used programs

We pointed Fuzzy at 100 of the most-used Solana programs, the first 100 in Orb's program directory on November 9, and put every result in a public registry. Agents can read it at fuzzy.verafy.ai/api/registry.

No run proved an exploit. Most scores are low, and that is the honest result: a low score means a shallow run, not a broken program. Only 36 of the 100 publish an Anchor IDL on chain, and 24 had recent calls Fuzzy could replay on cloned mainnet state through a public RPC. Without either, Fuzzy cannot tell what the instructions are, so it tries little. The highest score was 53.

The run also caught a bug in Fuzzy itself. Replay runs with signature checks off, and one early replay "proved" a theft from a payments program by keeping the real sender as a signer, in effect forging their signature. We changed the engine so an attack can never rely on a signature the attacker does not hold, and rescanned every replayed program. A scan is a grade; only a jury ruling makes a certification.

Replay got better in the same pass. Many real transactions do setup work before the call Fuzzy cares about, such as creating a token account, and the program's own clock check depends on when the call ran. Fuzzy now replays the earlier instructions in each transaction and sets its copy of Solana's clock to match. Pump.fun AMM went from 17 to 44 on the same budget. A Deep run of all 100 programs, with branch coverage, is running now, and the registry updates as it finishes.

A report card for every program

Click any program in the registry and you get its report card: what the program does, its certification stamp, links to it on the Verafy Explorer, Solana Explorer and Solscan, every assessment and whether it held, the Depth breakdown, and the exact build it covers.

Every certification has a grade

Each certification carries a grade, like a transcript. The letter is the level the jury ruled: A for Hardened, B for Fuzzed, C for Sniffed. Plus or minus comes from the Fuzzy Score within that level. A run too shallow to judge gets I, for incomplete, so a shallow scan never brands a program as failing. A proven exploit gets F. The grade is read from two bytes already stored in the certification account on Solana, the jury's level and the score, so anyone can recompute it.

Twelve programs whose runs reached Depth 40 or more carry a devnet certification, graded C or C minus: Jupiter's order engine, Metaplex Token Metadata, Kamino Farms and nine more. A jury of four registered harnesses from four model families ruled on each report on Solana devnet. These are devnet certifications only, and the jurors voted by script. Each one links to its certification account, its jury ruling and every juror's vote, and the Verafy Explorer shows all of them.

Ask from your agent

Fuzzy has a remote MCP server. Add https://fuzzy.verafy.ai/api/mcp to any MCP client, with no key, and an agent gets fuzzy_lookup, fuzzy_certification and fuzzy_registry_search. In Claude Code:

claude mcp add --transport http fuzzy https://fuzzy.verafy.ai/api/mcp

The Docs cover the MCP server, the HTTP API, the command line and how to read a certification straight from Solana.

The rules can't be quietly loosened

A certification is only worth something if its rules hold. Fuzzy's rules live in a charter with protected articles: only proven findings count, a certification names one exact build, only a jury certifies, and nothing already issued ever changes. Anyone can propose an amendment. A Verafy jury adopts it only if every protected article still holds, and when the jury is unsure, the answer is no.

A prototype, for now

Fuzzy is a prototype. A high score means a program survived these attacks; it is not an audit and not a promise of safety. A Sniff run does not measure branch coverage, so it scores 60 at most; Deep Fuzz measures it. Certifications live on Verafy Devnet today. When Verafy Chain is ready for prime time, we plan to move them there.

Look a program up or scan one at fuzzy.verafy.ai, and read the code and the charter on GitHub.