Graphite — Roadmap

Phase 1 (COMPLETE — v0.1.0-alpha, frozen)

Phase 1 Honest Status

The benchmark is 16 scored cases (safe + malicious) plus 2 baseline comparisons — NOT a statistical evaluation on unseen data. "100% precision / 100% recall on scored cases" is the honest claim. Of the exploit cases, 2 are SYNTHETIC reconstructions (CLINKSINK-style, AAT-style) using real program IDs but fabricated account structures and no instruction data bytes. The other 3 are REAL mainnet data (Wormhole $320M hack, CLINKSINK STMT drainer TX 64tsGGe, SlowMist AAT drainer TX 524t8LW) with actual instruction data from published security research. All are labeled per P16.

TOCTOU Mitigation (Phase 1.5 Partial)

The content_hash field is a SHA-256 hash of the transaction configuration — program ID, instruction discriminator, account addresses, instruction data, and CPI targets. This means each verification result is cryptographically tied to the exact transaction it verified.

Phase 1.5 limitation: Graphite verifies the transaction structure but does not re-hash the final signed transaction against the approved content_hash before execution. Full TOCTOU prevention requires the executor (SAK integration) to verify that the executed transaction matches the verified one — Phase 2 AuditBind middleware.

Phase 1.5 (COMPLETE — devnet verified Aug 7, 2026)

Extreme adversarial test suite (50+ tests)
Real exploit pattern reconstructions (5 classes, honestly labeled SYNTHETIC)
SAK integration rebuilt with real solana-agent-kit v2 imports — VERIFIED ON DEVNET
Pre-flight account reconstruction (wallet authority always present)
Case-sensitive intent parsing (Solana addresses are case-sensitive)
content_hash field for deterministic verification (P2)
.github CI templates + issue templates
LICENSE, SECURITY.md, CONTRIBUTING.md

Phase 1.5 Honest Status

The SAK integration is code-complete with real imports and verified on Solana devnet (Aug 7, 2026):

Imports solana-agent-kit v2 (real npm package, not an HTTP wrapper)
Imports @solana-agent-kit/plugin-token and @solana-agent-kit/plugin-defi
Uses real SAK API: SolanaAgentKit, KeypairWallet, .use(), .methods.swap()
Imports the Graphite TS SDK (GraphiteClient)
Every transaction goes through Graphite verification before SAK execution
Pre-flight account reconstruction: wallet authority + program IDs always present
If Graphite blocks, the transaction is NOT submitted to the network
5 finalized transactions on Solana devnet (2 faucet airdrops + 3 SAK test transfers), wallet CWb8MciizembLV66kisYcXo3Cb91hdszxw74QHpEJKZR — latest signature xHa4dyuFS6JmSaTsmhcMpEtwbWnPjBoUGwk3wNixD2uw2Wmeui6GhnSmmdzNVkv85zXSd6g7QYhHymAjciwP3jJ confirmed and finalized. SAK → Graphite pipeline confirmed end-to-end.

Phase 1.5 Exit Criteria (all checked)

Phase 2 (COMPLETE — v0.2.0-beta tagged at C54)

Month 1: Real Data + Protocol Expansion

Fetch REAL exploit transactions from Solana RPC (raw instruction bytes) — 3 pinned mainnet exploits scored in the benchmark (C30); 35 real mainnet exploit signatures from SolPhishHunter arXiv:2505.04094 + 3 real successful mainnet txs in the holdout corpus (C41); C52 fetched 2 more live from api.mainnet-beta.solana.com — fresh Aug-2026 drainer chain TX 2AWwL6dk (unknown 8MjG72/GieMfa5 + known HELPER, real Token-2022 mintTo) + AAT mass drain TX 3PbK87 (20 calls, real disc 0e) — exploit corpus now 37, both scored as REAL benchmark cases with raw evidence in scripts/real_exploit_*.json
Feed actual transaction data through Graphite (not synthetic reconstructions) — src/live_corpus.rs + graphite regression seed-live (2026-08-08): live devnet verified=20 / recorded=20, live test verified 10 real devnet txs, 3 pinned REAL mainnet fixtures (Jupiter swap, pump.fun market, System) through the full pipeline
Add 6 more protocol manifests (Pump.fun, Jupiter DCA, Wormhole Core, Metaplex Token Metadata — C27; Drift + Kamino — C42): 22 total at the time; 28 total with C46 (Phoenix, OpenBook V2, Switchboard, Jupiter Limit, Solend, Marginfi); 33 total with C56 (Raydium CLMM/CPMM, Marinade, SPL Stake Pool, Orca TokenSwap V2), all program IDs confirmed executable on mainnet
Regression Engine core: append-only fixture corpus, deterministic replay, P10 promotion gate (99.5%), benchmark-seeded initial corpus, graphite regression CLI gate — 12 tests (2026-08-07)
Replace synthetic exploit tests with real on-chain data — 3 REAL mainnet exploit cases (STMT drainer 64tsGGe, AAT drainer 524t8LW, Wormhole $320M hack 5fKWY7X) scored in the P16 benchmark binary, replacing 3 of 5 SYNTHETIC reconstructions (C30); 2 SYNTHETIC remain, honestly labeled
Multi-instruction transaction analysis — coordinated mass-drain patterns ACROSS instructions in one tx (AAT approve+transfer, authority-hijack SetAuthority+Transfer, close-and-sweep, mass multi-transfer sweep, AAT ownership-theft via System assign) — hard gates (C29)
CPI instruction trace analysis — unknown, re-entered (compositional), or vanity-impersonated programs in the hierarchical CPI tree; deep-chain warning — hard gates except the depth warning (C29)
Dynamic PDA seed resolution: extraction capability implemented + tested (2026-08-08) — {instruction_data}, {instruction_data:start:end}, {instruction_data:start} templates, 5 tests with known-answer PDAs pinned from the official Solana JS SDK + a false-positive guard. (C42: Kamino V2 lending_market_authority PDA seeds verified and added. C52: Jupiter DCA + Squads V4 layouts confirmed from official IDL/source and VERIFIED against live mainnet — DCA ["dca", user, inputMint, outputMint, uid] derives exactly the live account; Squads ["multisig", "multisig", createKey] derives exactly the real multisig; both manifests rebuilt with correct account order/roles; 4 new known-answer PDA tests.)

Month 2: Manifest Registry + Plugin Framework

Manifest Registry with signature verification + G5 reviewer reputation — graphite registry register-reviewer|submit|reviewers operator CLI (2026-08-08), live-verified signed submission ACCEPTED at derived tier
Community submission workflow (PR-based) — Phase 3
Plugin framework: 6 interfaces
2 real reference plugins
AuditBind middleware (TOCTOU prevention — re-hash signed tx vs approved content_hash)

Month 3: Live Integration + Dashboard

Phase 2 Exit Criteria

Benchmark uses real on-chain transaction data — 5 REAL mainnet exploit cases (STMT drainer 64tsGGe, AAT drainer 524t8LW, Wormhole $320M hack 5fKWY7X, fresh Aug-2026 drainer chain 2AWwL6dk, AAT mass drain 3PbK87) pinned in the P16 benchmark binary from tests/real_onchain_exploits.rs + live-fetched scripts/real_exploit_*.json (real program IDs, accounts, CPI structure; reproducible offline), replacing 3 of the 5 SYNTHETIC reconstructions; 2 SYNTHETIC cases remain, honestly labeled, for classes not yet pinned from mainnet
SAK integration executes real devnet transactions after Graphite approval — 5 finalized devnet txs, re-verified on-chain 2026-08-08
Protocol Manifest Registry accepts signed community submissions — CLI operator path live-verified (signed → ACCEPTED at derived tier; unregistered → REJECTED)
Plugin framework has 2+ real plugins
L3 and L8 pipeline layers live-validated — L3 against real devnet RPC, L8 against real mainnet RPC (C40); production default-on wiring remains pending public deployment
TOCTOU prevention via AuditBind middleware
Dashboard shows live verification state
1,000+ meaningful regression fixtures (2,181 corpus, C41)
Real holdout evaluation with independent labels (38 fixtures, 0 FN, C41)

Phase 3+ (Future)

Phase 3 (Production): Mainnet deployment, professional security audit, enterprise integrations
Phase 4 (Ecosystem): Standard verification layer for Solana AI agents
Phase 5 (Multi-chain, exploratory): Evaluate SVM-compatible chains only — full rewrite required for non-SVM chains

FilesExpand file tree

ROADMAP.md

Latest commit

History