Account validation is central
Solana programs receive accounts from transactions. Security depends on verifying signer status, ownership, mutability, executable status, PDA derivation, and whether the account is the one the instruction expects.
PDA security
Programs should validate seeds, bumps, and authority relationships. A PDA that is derived correctly but used for the wrong state or authority can still break protocol assumptions.
CPI and remaining accounts
Cross-program invocation creates risk when target programs or remaining accounts are attacker controlled. Auditors should check arbitrary CPI, confused accounts, signer propagation, and token-program assumptions.
Initialization and state
Initialization, realloc, close, rent, and deserialization paths need careful review because stale or attacker-supplied state can change how later instructions behave.
Anchor constraints
Anchor constraints are valuable, but they must encode the real invariant. Missing has_one, seeds, owner, signer, or constraint checks can leave a critical path open.
Next step
Use this guide to improve your scope, then request a review when the contracts, documentation, and tests are ready for a frozen commit audit.