Account validation is central
Solana programs receive accounts from transactions. Security depends on verifying signer status, ownership, mutability, executable status, PDA derivation, and whether the account is the one the instruction expects.
PDA security
Programs should validate seeds, bumps, and authority relationships. A PDA that is derived correctly but used for the wrong state or authority can still break protocol assumptions.
CPI and remaining accounts
Cross-program invocation creates risk when target programs or remaining accounts are attacker controlled. Auditors should check arbitrary CPI, confused accounts, signer propagation, and token-program assumptions.
Initialization and state
Initialization, realloc, close, rent, and deserialization paths need careful review because stale or attacker-supplied state can change how later instructions behave.
Anchor constraints
Anchor constraints are valuable, but they must encode the real invariant. Missing has_one, seeds, owner, signer, or constraint checks can leave a critical path open.
Test relationships between valid accounts
A useful negative test supplies an account that has a valid layout and owner but belongs to another user's position. Test that the instruction rejects the mismatch before moving assets or updating balances. Repeat across initialization, normal operation, and closure. Validation needs to establish the intended account relationship throughout the lifecycle.
Document token and integration assumptions
List the supported token programs, mint behavior, external programs, and authorities. Include fixtures for the configurations actually accepted by the application. When a new token extension or external program is supported, review how it changes transaction construction, received balances, and withdrawal behavior instead of assuming the previous integration tests are sufficient.
Discuss Your Audit Scope
Start with your email and a short project description. Technical details can follow. Request a smart contract audit quote or review public CTDSEC audit examples.