The vulnerability in the Anchor framework stems from a logic error in versions 1.0.0 through 1.0.1 that allows any executable account to be treated as the Solana system program. The code compares a program’s identifier with a default public key rather than the true system program ID, enabling the false assumption that a passed-in program of type Program<'info, System> is, in fact, the system program. Attackers can exploit this by providing a different program address, thereby causing the vulnerable program to perform unintended cross‑program invocations (CPI) or bypass expected payment logic. This flaw can be leveraged to execute arbitrary code or to divert funds without the program’s author’s consent.

Solana Foundation’s Anchor framework is affected in all releases from the initial 1.0.0 up to (but excluding) 1.0.2. Users building Solana programs with these versions of Anchor are vulnerable unless the framework has been upgraded.

The CVSS score of 8.2 indicates a high severity of the flaw. Although the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog, indicating no pre‑existing verified exploits have been documented to date. The likely attack vector requires an attacker to supply a custom program that targets a vulnerable Anchor‑based program, taking advantage of the unchecked identity of the system program reference. If both a malicious program and the vulnerable code are under the attacker’s control, they can orchestrate arbitrary CPI or payment bypasses exactly as the system program would be expected to perform.