Scans Target Solana “Surfpool” Testnet Endpoints, Raising API Exposure Risks
What Happened — Security researchers observed automated scans probing public “surfpool” endpoints that developers use to test Solana programs before main‑net deployment. The scans enumerate JSON and gRPC API surfaces, potentially exposing mis‑configured services.
Why It Matters for Compliance & Audit Readiness
- Unauthenticated API enumeration is a classic precursor to credential‑theft or data‑exfiltration, exactly the scenario SOC 2 Access Controls (CC6.1) are designed to prevent and evidence.
- Continuous monitoring of API access logs and proof of least‑privilege policies provide defensible audit evidence that your organization is managing third‑party and internal access appropriately.
- Mapping this exposure to your SOC 2 readiness program demonstrates due‑diligence to regulators and partners who expect robust API security controls.
Who Is Affected – blockchain platforms, crypto‑payment services, and any SaaS providers exposing JSON/gRPC APIs for developer testing.
Recommended Actions
- Inventory all publicly reachable Solana‑related endpoints and classify them as production vs. test.
- Enforce authentication and rate‑limiting on test‑net APIs; log all access attempts for continuous‑control monitoring.
- Align the API inventory and access‑control policies with SOC 2 CC6.1 (Logical Access Controls) and capture evidence in your compliance repository.
Source: SANS Internet Storm Center – Scan Diary
Technical Notes – The scans target the “surfpool” implementation used for pre‑deployment testing; endpoints expose JSON and gRPC interfaces without authentication. No CVE is cited, but the activity highlights a mis‑configuration risk that could be leveraged for credential harvesting.