Security scanner for Solana programs

AccountInfo or UncheckedAccount fields with authority-role names lacking signer constraints — allows attackers to pass unsigned accounts as authorities.

AccountInfo or UncheckedAccount fields with no owner or address constraint — attacker can pass an account owned by any program.

CPI calls via invoke, invoke_signed, or invoke_unchecked without prior program ID validation — allows substitution of a malicious program.

Account data read after a CPI call without reload() — program operates on stale state that may have been modified by the called program.

Data-account fields declared as AccountInfo<'info> instead of Account<'info, T> — bypasses Anchor's owner and discriminator validation.

PDA-like account constraints missing both seeds and bump components — proper PDA derivation requires both tied to trusted inputs.

Anchor account fields using init_if_needed — pattern can permit unintended re-initialization or state reset.

Account reallocation without realloc::zero = true — reallocated memory may contain stale data readable by the program or attackers.

CPI target program typed as AccountInfo<'info> instead of Program<'info, T> — skips program ID validation, allowing any program substitution.

AccountInfo or UncheckedAccount fields with authority-role names lacking signer constraints — allows attackers to pass unsigned accounts as authorities.

AccountInfo or UncheckedAccount fields with no owner or address constraint — attacker can pass an account owned by any program.

CPI calls via invoke, invoke_signed, or invoke_unchecked without prior program ID validation — allows substitution of a malicious program.

Account data read after a CPI call without reload() — program operates on stale state that may have been modified by the called program.

Data-account fields declared as AccountInfo<'info> instead of Account<'info, T> — bypasses Anchor's owner and discriminator validation.

PDA-like account constraints missing both seeds and bump components — proper PDA derivation requires both tied to trusted inputs.

Anchor account fields using init_if_needed — pattern can permit unintended re-initialization or state reset.

Account reallocation without realloc::zero = true — reallocated memory may contain stale data readable by the program or attackers.

CPI target program typed as AccountInfo<'info> instead of Program<'info, T> — skips program ID validation, allowing any program substitution.

AccountInfo or UncheckedAccount fields with authority-role names lacking signer constraints — allows attackers to pass unsigned accounts as authorities.

AccountInfo or UncheckedAccount fields with no owner or address constraint — attacker can pass an account owned by any program.

CPI calls via invoke, invoke_signed, or invoke_unchecked without prior program ID validation — allows substitution of a malicious program.

Account data read after a CPI call without reload() — program operates on stale state that may have been modified by the called program.

Data-account fields declared as AccountInfo<'info> instead of Account<'info, T> — bypasses Anchor's owner and discriminator validation.

PDA-like account constraints missing both seeds and bump components — proper PDA derivation requires both tied to trusted inputs.

Anchor account fields using init_if_needed — pattern can permit unintended re-initialization or state reset.

Account reallocation without realloc::zero = true — reallocated memory may contain stale data readable by the program or attackers.

CPI target program typed as AccountInfo<'info> instead of Program<'info, T> — skips program ID validation, allowing any program substitution.