Decoder coverage
Eight programs. 80+ instructions. Every decoder registers itself under its canonical program ID and emits the same DecodedInstruction shape. Unknown programs fall back to a MEDIUM verdict with a human-review reason.
System Program
Program ID: 11111111111111111111111111111111
Decoder kind: native
Solana runtime core. Account creation, SOL transfers, nonce lifecycle. Instructions are dispatched by a 4-byte LE tag at offset 0.
| instruction | default risk | description |
|---|---|---|
| CreateAccount | low | Create a new account with lamports, space, and owner. |
| Transfer | low | Move SOL between accounts. Escalated to HIGH for transfers ≥100 SOL. |
| CreateAccountWithSeed | low | Create a PDA-style account deterministically. |
| AdvanceNonceAccount | medium | Advance a durable nonce. The canonical first-instruction signal for a durable-nonce tx. |
| InitializeNonceAccount | medium | Set up a durable-nonce account and its authority. |
| Allocate | low | Allocate data space to an account. |
SPL Token
Program ID: TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA
Decoder kind: native
Classic SPL Token program. Instructions are dispatched by a 1-byte tag at offset 0.
| instruction | default risk | description |
|---|---|---|
| Transfer | low | Move tokens. Escalated to MEDIUM at ≥1e9 raw units, HIGH at ≥1e12. |
| TransferChecked | low | Transfer with explicit mint + decimals verification. |
| MintTo | high | Mint new tokens. Always HIGH — an inflationary action. |
| Burn | medium | Destroy tokens from a holder account. |
| CloseAccount | medium | Close a token account and reclaim rent. |
| SetAuthority | high | Change the authority on a mint or account. Ownership transfer. |
Token-2022
Program ID: TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb
Decoder kind: native
Token program extensions. Reuses SPL Token tags 0..=25 for base instructions; tags 26+ are extension-specific and get dedicated handlers.
| instruction | default risk | description |
|---|---|---|
| Transfer / MintTo / Burn / ... | low | Base instructions (tags 0-25) delegate to the SPL Token decoder. |
| initialize_non_transferable_mint | high | Create a mint whose tokens cannot be transferred after mint. |
| transfer_hook_extension | high | Register a custom program that runs on every transfer. |
| interest_bearing_mint_extension | medium | Enable interest-bearing logic on the mint. |
| initialize_permanent_delegate | critical | Install a permanent delegate with unilateral move-token power over every holder of this mint. |
| confidential_transfer_extension | medium | Confidential-transfer extension ix. |
| + 9 more extensions | medium | Reallocate, default_account_state, memo_transfer, cpi_guard, metadata_pointer, etc. |
Squads v4
Program ID: SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf
Decoder kind: custom anchor
Multisig governance program — the same one Drift used. Custom decoder because the Drift 2026 reasoning is not expressible as a plain static table.
See /docs/drift-2026 for the full account of how this decoder maps onto the exploit.
| instruction | default risk | description |
|---|---|---|
| vault_transaction_create | high | Queue a transaction that will spend from the multisig vault when approved. |
| vault_transaction_execute | critical | Execute a previously approved vault tx — moves funds out of the vault now. |
| config_transaction_create | high | Queue a multisig config change (threshold / members / timelock). |
| config_transaction_execute | critical | Execute a config change. This is the class of instruction used in the April 2026 Drift exploit. |
| proposal_create | medium | Create a new proposal on the multisig. |
| proposal_approve | high | Approve a proposal. Your signature contributes to the threshold. |
| proposal_reject | low | Reject a proposal. |
| multisig_create / v2 | medium | Create a new multisig. |
| multisig_set_config | critical | Directly mutate multisig config — signers / threshold / timelock. |
Jupiter v6
Program ID: JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4
Decoder kind: anchor
The dominant Solana DEX aggregator. Matched via Anchor discriminators.
| instruction | default risk | description |
|---|---|---|
| route | medium | Execute a swap along a chosen route. |
| route_with_token_ledger | medium | Swap using a token ledger account. |
| exact_out_route | medium | Exact-output swap. |
| shared_accounts_route | medium | Default swap used by most frontends. |
| shared_accounts_route_with_token_ledger | medium | Shared-accounts swap with ledger. |
| shared_accounts_exact_out_route | medium | Shared-accounts exact-out swap. |
| set_token_ledger / create_open_orders / claim / claim_token | low | Ancillary bookkeeping instructions. |
Drift v2
Program ID: dRiftyHA39MWEi3m9aunc5MzRF1JYuBsbn6VPcn33UH
Decoder kind: anchor
Drift Protocol — the program whose governance was hijacked in the April 2026 exploit. The user-facing instructions themselves are standard deposit / trade / liquidate flows.
| instruction | default risk | description |
|---|---|---|
| initialize_user / initialize_user_stats | low | Create the user account and stats under the signer. |
| deposit / withdraw / transfer_deposit | medium | Move collateral in and out of Drift vaults. |
| place_perp_order / place_spot_order / place_and_take_perp_order | medium | Open orders against perp or spot markets. |
| cancel_order / cancel_orders / settle_pnl | low | Cancel orders, settle realized PnL. |
| liquidate_perp / liquidate_spot / liquidate_borrow_for_perp_pnl | high | Third-party liquidations — verify target user and keeper. |
| update_user_delegate | high | Set a delegate that can trade on the user account. |
| update_user_name / update_amms | low | Cosmetic and oracle refresh instructions. |
Kamino Lend
Program ID: KLend2g3cP87fffoy8q1mQqGKjrxjC8boSyAYavgmjD
Decoder kind: anchor
Money market with obligation-based borrowing. Reserve and obligation operations are the user-facing surface.
| instruction | default risk | description |
|---|---|---|
| init_obligation / refresh_obligation / refresh_reserve | low | Bookkeeping and oracle refresh. |
| deposit_reserve_liquidity / redeem_reserve_collateral | medium | Supply liquidity / redeem cTokens. |
| deposit_obligation_collateral | medium | Post cTokens as obligation collateral. |
| withdraw_obligation_collateral | high | Reduce obligation collateral — increases liquidation risk. |
| borrow_obligation_liquidity | high | Open a new debt position against the obligation. |
| repay_obligation_liquidity | low | Repay outstanding debt. |
| liquidate_obligation_and_redeem_reserve_collateral | high | Third-party liquidation. |
| flash_borrow_reserve_liquidity / flash_repay_reserve_liquidity | medium | Flash-borrow pair — must balance in the same tx. |
MarginFi v2
Program ID: MFv2hWf31Z9kbCa1snEPYctwafyJVi6rmTeBd8NsGRf
Decoder kind: anchor
Isolated-margin money market. Each user holds a marginfi_account under a marginfi_group.
| instruction | default risk | description |
|---|---|---|
| marginfi_account_initialize | low | Create a new marginfi account under a group. |
| lending_account_deposit / withdraw | medium | Supply / withdraw from a lending bank. |
| lending_account_borrow | high | Open a new debt position. |
| lending_account_repay | low | Repay debt. |
| lending_account_liquidate | high | Liquidate an unhealthy marginfi account. |
| lending_account_start_flashloan / end_flashloan | medium | Flashloan begin / end pair. |
| marginfi_account_set_account_authority | critical | Transfer control of the marginfi account to a new authority. Full takeover. |