Skill

Solana Incident Response Skill

The minutes after an exploit decide how much you keep. This skill turns a panicking founder or on-call engineer into an organized incident commander with a phase-by-phase runbook, the right contacts, and the right on-chain moves — fast, reversible-by-default, and human-gated on anything destructive.

⚠️ Operational support, not legal advice and not a guarantee of recovery. This skill helps you respond faster and more correctly. It does not replace SEAL 911, your security firm, or counsel. Every fund-moving or program-changing action requires explicit human authority-holder approval. See DISCLAIMER.md.

When To Use This Skill

Trigger on any of:

• Active exploit — TVL is draining, unexpected withdrawals, a program is being abused right now.
• Suspected compromise — a signer key, deployer, multisig member, or CI/CD pipeline may be compromised; pre-signed transactions may exist.
• Malicious or mistaken upgrade — an unexpected program upgrade, authority transfer, or config change landed.
• Drained treasury / wallet — project funds, vesting, or a user's wallet moved without authorization.
• Failing in prod — a critical instruction is reverting or misbehaving on mainnet and may be exploitable.
• Pre-incident readiness — "build us an incident runbook", "set up a war-room plan", "run an IR drill".

If the user is writing new program code or wants a code audit, route to the auditor/security skills instead. This skill starts where the audit ended: something is wrong in production, now.

First Move (read this before anything else)

When an incident is reported, do these in order and do not skip:

1. Stabilize the human. State the plan in one line: "We'll contain, then investigate, then trace — I'll gate every irreversible step on your approval."
2. Open SEAL 911 in parallel. It is free, 24/7, and staffed by vetted responders who can pull in exchanges and other protocols. Telegram: @seal_911_bot / see resources.md. Do this even if you think you can handle it — it costs nothing and starts the freeze clock.
3. Classify the incident (see table below) — this picks your containment path.
4. Start the war-room log. Every action, timestamp, tx signature, and decision goes in one append-only doc (template: war-room-roster.md). This is your post-mortem and your legal record.
5. Do NOT broadcast publicly yet, do NOT interact with the attacker, do NOT push an untested fix to mainnet. Containment first.

Classify The Incident → Pick The Path

Symptom	Likely class	Go to
Funds leaving via a program instruction	Smart-contract exploit	contain.md → pause/upgrade
Unexpected upgrade / authority change	Key or pipeline compromise	contain.md → revoke/rotate
Multisig approved something nobody recognizes	Social-engineering / pre-signed tx	contain.md → multisig lockdown
One wallet drained, programs fine	Private-key / seed leak	trace-funds.md + SEAL 911
Token mint/supply anomaly	Mint authority abuse	contain.md → freeze/mint-authority
Program reverts / misbehaves in prod	Bug, possibly exploitable	investigate.md → replay first
Autonomous agent manipulated / halted / draining	Agent-specific failure	agent-incidents.md
Not sure yet	Unknown	detect.md → confirm scope

2026 reality check: the largest recent Solana loss — the ~$286M Drift exploit (April 2026) — did not break the smart contract. It used social engineering to get pre-signed multisig transactions (via durable nonces) that stayed valid for over a week. If keys/process may be compromised, treat multisig and pending transactions as hostile, not just the program. (See coordinate.md and resources.md.)

The Five Phases (Progressive Disclosure — load only what you need)

1. DETECT — confirm, scope, and freeze the timeline → detect.md

Confirm it's real (not an RPC glitch), establish blast radius, identify affected programs/accounts/tokens, set up live monitoring on the attacker address (Helius webhooks), and snapshot state before it changes.

2. CONTAIN — stop the bleeding, reversibly where possible → contain.md

Pause guardians, emergency-admin instructions, upgrade-authority moves, mint/freeze-authority actions, multisig lockdown, revoking pending/pre-signed transactions, and circuit-breaker patterns. Every action here is authority-gated and logged.

3. INVESTIGATE — root cause without touching mainnet → investigate.md

Fork mainnet with Surfpool, replay the exploit transaction at the exact slot, profile compute units and account diffs, isolate the vulnerable instruction, and confirm the fix on the fork before any redeploy.

4. TRACE — follow and freeze the funds → trace-funds.md

Map outflows with Helius Enhanced Transactions, label hops with Arkham / MistTrack / Range, identify CEX deposit and bridge addresses, and push freeze requests through SEAL 911 and exchange security contacts within the 72-hour window.

5. RECOVER — restore service and make users whole → recover.md

Whitehat/Safe Harbor negotiation, recovery-address handling, patched redeploy, treasury reseed, reimbursement mechanics, and the decision tree for resume-vs-stay-down.

Cross-cutting: COORDINATE → coordinate.md

SEAL 911, SIRN, STRIDE, Immunefi, exchanges, validators, and counsel — who to call, in what order, and what to tell them. Includes the Safe Harbor rules of engagement for whitehats.

Cross-cutting: DISCLOSE → disclose.md

Holding statement → user comms → full post-mortem → regulator/counsel notes. Templates included. Never publish details that re-enable the exploit while funds are still at risk.

Distinct surface: AGENT INCIDENTS → agent-incidents.md

Autonomous AI agents fail differently — prompt injection, key compromise, silent halt/liveness, MEV bleed, oracle deviation, protocol contagion — and need deterministic tripwires, not just human alerts. Includes the agent failure-mode table, a machine-checkable trigger taxonomy that feeds DETECT, pre-deployment risk scoring, and risk-transfer/coverage options.

Before it happens: PREPARE → preparedness.md

Build the runbook, define authority-holders and a war-room roster, wire monitoring, pre-sign Safe Harbor, and run tabletop drills (/ir-drill).

Pick The Right Agent

Situation	Agent	Model
Running the whole incident, decisions & sequencing	incident-commander	opus
Replaying the exploit, tracing funds, forensics	forensics-analyst	opus
Holding statements, post-mortems, user/regulator comms	comms-officer	sonnet

Commands

Command	Purpose
/ir-triage <tx sig | symptom>	Classify the incident and produce the first-15-minutes action list
/ir-contain	Generate the authority-gated containment plan for the classified incident
/ir-trace <address>	Build the fund-flow map and freeze-request package
/ir-postmortem	Draft the post-mortem from the war-room log
/ir-drill	Run a tabletop exercise against a chosen scenario

Safety Rails (always on — see rules/incident-response.md)

• Read-only by default. This skill investigates and proposes; it never signs, sends, or upgrades on its own.
• Human gate on irreversibility. Pausing, upgrading, transferring authority, freezing, or moving funds requires an explicit named authority-holder to approve and execute.
• No attacker contact without an agreed strategy (usually via SEAL 911 / counsel).
• Preserve evidence. Snapshot before you change state; log every action with timestamps and signatures.
• Devnet/fork first. Any fix is reproduced and verified on a Surfpool fork before mainnet.

Relationship To The Rest Of The Kit

This skill does not duplicate the kit's audit/security stack — it consumes it:

• Vulnerability classes and code-level checks → ext/trailofbits, ext/safe-solana-builder, ext/ghostsecurity, ext/qedgen (formal verification).
• Forked-state replay primitive → Surfpool MCP (already in the kit) and /debug-user-tx.
• On-chain data → Helius MCP (already in the kit).
• Legal/regulatory follow-through → crypto-legal-skill.

This skill is the playbook and coordination layer that orchestrates those during a live crisis — the piece the kit is missing.