Solana Vulnerability Scanner

// VULNERABLE: User-provided program ID without validation
pub fn transfer_tokens(
    ctx: Context<TransferTokens>,
    amount: u64,
) -> Result<()> {
    // User provides token_program account
    let token_program = &ctx.accounts.token_program;

    // WRONG: No check that token_program.key() == spl_token::ID!
    invoke(
        &spl_token::instruction::transfer(...),
        &[
            ctx.accounts.from.to_account_info(),
            ctx.accounts.to.to_account_info(),
            token_program.to_account_info(),  // ATTACKER CONTROLLED!
        ],
    )?;
    Ok(())
}

// VULNERABLE: Native Solana without validation
pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let token_program = next_account_info(accounts_iter)?;

    // WRONG: No validation of token_program.key
    invoke(
        &transfer_instruction,
        &[from_account, to_account, token_program],  // Unvalidated!
    )?;
    Ok(())
}

// SECURE: Validate program ID (Native)
use spl_token;

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let token_program = next_account_info(accounts_iter)?;

    // CRITICAL: Validate program ID
    if token_program.key != &spl_token::ID {
        return Err(ProgramError::IncorrectProgramId);
    }

    // Safe to invoke
    invoke(
        &spl_token::instruction::transfer(...),
        &[from_account, to_account, token_program],
    )?;
    Ok(())
}

// SECURE: Use Anchor Program type with constraint
use anchor_spl::token::{Token, TokenAccount};

#[derive(Accounts)]
pub struct TransferTokens<'info> {
    #[account(mut)]
    pub from: Account<'info, TokenAccount>,
    #[account(mut)]
    pub to: Account<'info, TokenAccount>,
    pub authority: Signer<'info>,
    // Program<'info, Token> automatically validates program ID
    pub token_program: Program<'info, Token>,
}

pub fn transfer_tokens(ctx: Context<TransferTokens>, amount: u64) -> Result<()> {
    // Anchor ensures token_program.key() == Token::id()
    let cpi_accounts = Transfer {
        from: ctx.accounts.from.to_account_info(),
        to: ctx.accounts.to.to_account_info(),
        authority: ctx.accounts.authority.to_account_info(),
    };

    let cpi_ctx = CpiContext::new(
        ctx.accounts.token_program.to_account_info(),
        cpi_accounts,
    );

    anchor_spl::token::transfer(cpi_ctx, amount)?;
    Ok(())
}

// VULNERABLE: Using create_program_address without bump validation
pub fn withdraw(ctx: Context<Withdraw>, bump: u8) -> Result<()> {
    // User provides bump
    let vault_seeds = &[
        b"vault",
        ctx.accounts.user.key().as_ref(),
        &[bump],  // WRONG: Attacker can provide non-canonical bump!
    ];

    let vault = Pubkey::create_program_address(vault_seeds, ctx.program_id)?;

    // This vault might not be the canonical PDA!
    // Attacker could create multiple PDAs and drain wrong vault
    Ok(())
}

// VULNERABLE: Not comparing with find_program_address result
pub fn initialize(ctx: Context<Initialize>, bump: u8) -> Result<()> {
    let pda_seeds = &[b"state", &[bump]];
    let pda = Pubkey::create_program_address(pda_seeds, ctx.program_id)?;

    // WRONG: Not verifying this is the canonical PDA
    // Should check pda == ctx.accounts.pda_account.key()
}

// SECURE: Use find_program_address (Native)
pub fn withdraw(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let vault_account = next_account_info(accounts_iter)?;
    let user_account = next_account_info(accounts_iter)?;

    // Find canonical PDA with bump
    let (vault_pda, bump) = Pubkey::find_program_address(
        &[b"vault", user_account.key.as_ref()],
        program_id,
    );

    // Verify provided account matches canonical PDA
    if vault_account.key != &vault_pda {
        return Err(ProgramError::InvalidAccountData);
    }

    // Use bump for signing
    let vault_seeds = &[
        b"vault",
        user_account.key.as_ref(),
        &[bump],
    ];

    invoke_signed(
        &transfer_instruction,
        &[vault_account, destination],
        &[vault_seeds],
    )?;

    Ok(())
}

// SECURE: Anchor with seeds constraint
#[derive(Accounts)]
pub struct Withdraw<'info> {
    #[account(
        mut,
        seeds = [b"vault", user.key().as_ref()],
        bump,  // Anchor automatically validates canonical bump
    )]
    pub vault: Account<'info, VaultAccount>,

    pub user: Signer<'info>,
}

pub fn withdraw(ctx: Context<Withdraw>, amount: u64) -> Result<()> {
    // Anchor has already validated vault is canonical PDA
    let bump = *ctx.bumps.get("vault").unwrap();

    let vault_seeds = &[
        b"vault",
        ctx.accounts.user.key().as_ref(),
        &[bump],
    ];

    // Safe to use in CPI
    let signer_seeds = &[&vault_seeds[..]];

    // CPI with PDA signer
    Ok(())
}

// BETTER: Store bump in account
#[account]
pub struct VaultAccount {
    pub bump: u8,  // Store canonical bump
    pub owner: Pubkey,
    pub balance: u64,
}

#[derive(Accounts)]
pub struct Initialize<'info> {
    #[account(
        init,
        payer = user,
        space = 8 + 1 + 32 + 8,
        seeds = [b"vault", user.key().as_ref()],
        bump,
    )]
    pub vault: Account<'info, VaultAccount>,

    #[account(mut)]
    pub user: Signer<'info>,
    pub system_program: Program<'info, System>,
}

pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
    let vault = &mut ctx.accounts.vault;
    vault.bump = *ctx.bumps.get("vault").unwrap();  // Store canonical bump
    vault.owner = ctx.accounts.user.key();
    vault.balance = 0;
    Ok(())
}

// VULNERABLE: Deserializing account without owner check
pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let vault_account = next_account_info(accounts_iter)?;

    // WRONG: No owner check before deserializing!
    let vault: Vault = Vault::try_from_slice(&vault_account.data.borrow())?;

    // vault could be fake account owned by attacker with fake balance!
    if vault.balance >= amount {
        // Process withdrawal using fake balance
    }

    Ok(())
}

// VULNERABLE: Anchor without owner constraint
#[derive(Accounts)]
pub struct Withdraw<'info> {
    /// CHECK: This is unsafe - no owner validation!
    pub vault: AccountInfo<'info>,
}

// SECURE: Validate owner before deserializing (Native)
pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let vault_account = next_account_info(accounts_iter)?;

    // CRITICAL: Validate owner
    if vault_account.owner != program_id {
        return Err(ProgramError::IncorrectProgramId);
    }

    // Safe to deserialize - we own this account
    let vault: Vault = Vault::try_from_slice(&vault_account.data.borrow())?;

    Ok(())
}

// SECURE: Use Anchor Account type (automatic validation)
#[derive(Accounts)]
pub struct Withdraw<'info> {
    #[account(mut)]
    pub vault: Account<'info, VaultAccount>,  // Anchor checks owner automatically
    pub user: Signer<'info>,
}

// For third-party program accounts
#[derive(Accounts)]
pub struct ProcessToken<'info> {
    #[account(mut)]
    pub token_account: Account<'info, TokenAccount>,  // Validates owner == Token program
    pub token_program: Program<'info, Token>,
}

// VULNERABLE: No signer check on authority account
pub fn withdraw(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    amount: u64,
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let vault = next_account_info(accounts_iter)?;
    let authority = next_account_info(accounts_iter)?;

    // WRONG: No check that authority.is_signer == true!
    // Attacker can provide any authority account and withdraw

    let vault_data: Vault = Vault::try_from_slice(&vault.data.borrow())?;

    // Check authority matches (but attacker provided this!)
    if vault_data.authority != *authority.key {
        return Err(ProgramError::InvalidAccountData);
    }

    // Process withdrawal - ATTACKER CAN CALL THIS!
    Ok(())
}

// VULNERABLE: Anchor without Signer type
#[derive(Accounts)]
pub struct Withdraw<'info> {
    #[account(mut)]
    pub vault: Account<'info, VaultAccount>,
    /// CHECK: Missing signer constraint!
    pub authority: AccountInfo<'info>,
}

// SECURE: Check is_signer (Native)
pub fn withdraw(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    amount: u64,
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let vault = next_account_info(accounts_iter)?;
    let authority = next_account_info(accounts_iter)?;

    // CRITICAL: Verify authority signed the transaction
    if !authority.is_signer {
        return Err(ProgramError::MissingRequiredSignature);
    }

    let vault_data: Vault = Vault::try_from_slice(&vault.data.borrow())?;

    // Now safe to check authority matches
    if vault_data.authority != *authority.key {
        return Err(ProgramError::InvalidAccountData);
    }

    // Process withdrawal - only if authority signed
    Ok(())
}

// SECURE: Use Anchor Signer type (automatic validation)
#[derive(Accounts)]
pub struct Withdraw<'info> {
    #[account(
        mut,
        has_one = authority,  // Also validate vault.authority == authority.key()
    )]
    pub vault: Account<'info, VaultAccount>,
    pub authority: Signer<'info>,  // Anchor checks is_signer automatically
}

pub fn withdraw(ctx: Context<Withdraw>, amount: u64) -> Result<()> {
    // Anchor has already validated:
    // 1. authority.is_signer == true
    // 2. vault.authority == authority.key()

    // Safe to proceed with withdrawal
    Ok(())
}

// For admin functions
#[derive(Accounts)]
pub struct UpdateConfig<'info> {
    #[account(
        mut,
        has_one = admin,
    )]
    pub config: Account<'info, Config>,
    pub admin: Signer<'info>,  // Must be signer
}

// VULNERABLE: Using unchecked load functions (Solana < 1.8.1)
use solana_program::sysvar::instructions;

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let instructions_sysvar = next_account_info(accounts_iter)?;

    // WRONG: load_instruction_at() doesn't validate sysvar account!
    let current_ix = instructions::load_instruction_at(0, instructions_sysvar)?;

    // Attacker can provide fake Instructions sysvar with spoofed instruction data!
    // Bypass authentication by faking previous instruction
}

// VULNERABLE: load_current_index() without validation
let current_index = instructions::load_current_index(instructions_sysvar)?;

// OPTION 1: Upgrade to Solana 1.8.1+ and use checked functions
use solana_program::sysvar::instructions;

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let instructions_sysvar = next_account_info(accounts_iter)?;

    // SECURE: load_instruction_at_checked validates sysvar account
    let current_ix = instructions::load_instruction_at_checked(
        0,
        instructions_sysvar
    )?;

    // Safe - sysvar is validated
    Ok(())
}

// OPTION 2: Manual validation (if on old Solana version)
pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let accounts_iter = &mut accounts.iter();
    let instructions_sysvar = next_account_info(accounts_iter)?;

    // Validate sysvar account address
    if instructions_sysvar.key != &solana_program::sysvar::instructions::ID {
        return Err(ProgramError::InvalidAccountData);
    }

    // Now safe to use unchecked function
    let current_ix = instructions::load_instruction_at(0, instructions_sysvar)?;

    Ok(())
}

// SECURE: Anchor with address constraint
#[derive(Accounts)]
pub struct CheckInstructions<'info> {
    /// CHECK: Validated against known sysvar address
    #[account(address = solana_program::sysvar::instructions::ID)]
    pub instructions_sysvar: AccountInfo<'info>,
}

// VULNERABLE: Absolute index in load_instruction_at
use solana_program::sysvar::instructions;

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let instructions_sysvar = &accounts[0];

    // WRONG: Using absolute index 0
    let prev_ix = instructions::load_instruction_at_checked(0, instructions_sysvar)?;

    // Attacker can craft transaction where instruction 0 is benign,
    // but instruction 1 (malicious) also loads instruction 0 for validation
    // Same instruction 0 used to validate both instruction 0 and 1!
}

// VULNERABLE: No correlation between instructions
pub fn withdraw(ctx: Context<Withdraw>) -> Result<()> {
    let instructions_sysvar = &ctx.accounts.instructions_sysvar;

    // Check that previous instruction was deposit
    let prev_ix = instructions::load_instruction_at_checked(0, instructions_sysvar)?;

    // WRONG: Not checking that prev_ix is actually related to current instruction
    // Could be completely unrelated instruction from earlier in transaction
}

// SECURE: Use relative indexing
use solana_program::sysvar::instructions;

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    let instructions_sysvar = &accounts[0];

    // Get current instruction index
    let current_index = instructions::load_current_index_checked(instructions_sysvar)?;

    // SECURE: Get immediately preceding instruction with relative index
    if current_index > 0 {
        let prev_ix = instructions::load_instruction_at_checked(
            (current_index - 1) as usize,
            instructions_sysvar
        )?;

        // This is guaranteed to be the instruction immediately before current
        // Validate prev_ix is the expected setup instruction
    }

    Ok(())
}

// BETTER: Use get_instruction_relative (if available)
let prev_ix = instructions::get_instruction_relative(-1, instructions_sysvar)?;
// Explicitly relative to current instruction

// SECURE: Additional correlation validation
pub fn withdraw(ctx: Context<Withdraw>) -> Result<()> {
    let instructions_sysvar = &ctx.accounts.instructions_sysvar;
    let current_ix_index = instructions::load_current_index_checked(instructions_sysvar)?;

    // Must have previous instruction
    require!(current_ix_index > 0, ErrorCode::NoPreviousInstruction);

    // Get previous instruction
    let prev_ix_index = current_ix_index - 1;
    let prev_ix = instructions::load_instruction_at_checked(
        prev_ix_index as usize,
        instructions_sysvar
    )?;

    // Validate previous instruction is deposit to same program
    require!(
        prev_ix.program_id == ctx.program_id,
        ErrorCode::InvalidPreviousProgram
    );

    // Validate accounts in previous instruction match expectations
    // This ensures proper correlation between deposit and withdraw
    require!(
        prev_ix.accounts[0].pubkey == ctx.accounts.vault.key(),
        ErrorCode::VaultMismatch
    );

    Ok(())
}