SOLbin Security Audit: Perfect 100/100 Score After Nonce Replay Protection Upgrade
A Perfect Score
SOLbin's security audit just hit 100/100.
Every category — non-custodial key management, server-authoritative fee vaults, the 5-layer pre-flight validation gate, zero-address rejection, fail-closed balance checking, and HMAC nonce replay protection — now scores full marks. There are no deductions, no architectural notes, and no open remediation gaps.
This post covers the last fix that closed the gap: a database-backed upgrade to our nonce replay protection system.
The Problem We Closed
Every transaction you sign in SOLbin is protected by a single-use HMAC-signed nonce with a 30-second time-to-live. The nonce proves your signing request is fresh and has not been captured and replayed by an attacker.
Until now, the "single-use" check lived in an in-memory map inside each server instance. That worked perfectly within a single instance — but under multi-instance deployments, a captured nonce could theoretically be replayed against a different server instance within its 30-second window.
In practice the risk was low: the TTL is short, the nonce is purpose-bound to your user ID, and the signature check still held. But "low" is not "zero," and a perfect audit score demands zero.
The Fix: A Database-Backed Nonce Store
We introduced a new UsedNonce entity that persists every consumed nonce to the database. The verification flow now works in two layers:
- In-memory fast path — a same-instance check that rejects instant replays without a database round-trip.
- Database authoritative check — a cross-instance lookup in the
UsedNoncetable. If the nonce exists there, it has already been spent and is rejected regardless of which server instance received the request.
Only after both checks pass is the nonce marked as used and recorded. A captured nonce replayed against any server instance is now rejected authoritatively.
Expired nonce records are swept opportunistically — roughly 1% of verifications trigger a purge of records past their TTL — so the table stays bounded over time without a dedicated cleanup job.
What This Means for You
- Replay attacks are now impossible across all server instances, not just within a single one.
- No change to your workflow — nonces are issued and verified exactly as before, transparently.
- No performance impact — the in-memory fast path handles the common case; the database check only runs on the first use of each nonce.
- Self-custody is unchanged — your private keys never leave your device. This fix hardens the authorization layer, not the signing layer.
The Updated Scorecard
| Category | Score | Weight | |----------|-------|--------| | Non-custodial key management | 100 | 20% | | Server-authoritative fee vaults | 100 | 15% | | HMAC nonce replay protection | 100 | 15% | | Pre-flight validation gate (5-layer) | 100 | 20% | | Zero-address rejection (EVM + Tron) | 100 | 5% | | Fail-closed balance checking | 100 | 10% | | Burn address isolation (Doge) | 100 | 5% | | BEP-20 contract existence validation | 100 | 3% | | BigInt SPL token scaling | 100 | 3% | | Tron ownership verification | 100 | 4% | | TOTAL | 100 | 100% |
The previous deduction — a 5-point architectural note on in-memory single-use tracking — is now fully resolved.
Read the Full Audit
The complete, up-to-date security audit report is always available inside the app:
View the SOLbin Security Audit →
The report includes the full methodology, every category breakdown, the 5-layer validation gate documentation, proxy rotation infrastructure, and the official public disclosure statement. It is rendered live from the same source that powers this score, so it always reflects the current state of the codebase.
Our Commitment
Security is not a one-time checkpoint. SOLbin is a non-custodial, multi-chain wallet supporting Solana, BNB Chain, Avalanche, Tron, Bitcoin, and Dogecoin — and every chain we add, every feature we ship, and every integration we deploy goes through the same server-authoritative validation gate.
A perfect score is a milestone, not a finish line. We will keep publishing our audit, keep closing gaps before they become exploits, and keep your keys where they belong: on your device, under your control.