Abstract:With the rapid adoption of the Solana blockchain, prior research has examined its security vulnerabilities, ecosystem, and commercial applications. However, concurrency defects in Solana on-chain programs have not received sufficient attention. This study identifies two special types of concurrency defects in Solana on-chain programs: transaction-order dependency defects and clock-control dependency defects. These defects allow malicious nodes in the blockchain network to legitimately reorder concurrent transactions or delay specific transactions until a specific time, thus affecting the execution outcomes of these concurrent transactions. As a result, concurrent transactions in Solana on-chain programs containing these defects may be vulnerable to adversarial control. To address this problem, this study defines transaction-order dependency defects and clock-control dependency defects in Solana on-chain programs and proposes a detection method based on fuzz testing and symbolic execution. The method includes detection criteria for both defect types, as well as a ledger simulation method and a transaction generation method tailored to the characteristics of the Solana blockchain. Based on this method, a prototype tool, SolRaceFuzz, is implemented, and experiments are conducted on three datasets to evaluate defect discovery capability, efficiency, and exploration strategy, verifying the effectiveness of the proposed method.