> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/solana-foundation/anchor/llms.txt
> Use this file to discover all available pages before exploring further.

# Security best practices

> Common security vulnerabilities and how to prevent them in Anchor programs

Learn about common security vulnerabilities in Solana programs and how Anchor helps prevent them.

## Missing signer checks

**Vulnerability**: Not verifying that an account signed the transaction.

**Anchor protection**: Use `Signer<'info>` type.

```rust theme={null}
// Secure
#[derive(Accounts)]
pub struct Update<'info> {
    pub authority: Signer<'info>,  // Automatically checked
}
```

## Missing ownership checks

**Vulnerability**: Not verifying account ownership.

**Anchor protection**: `Account<'info, T>` automatically checks owner.

```rust theme={null}
// Secure - owner checked automatically
#[account(mut)]
pub data: Account<'info, MyData>
```

## Missing account validation

**Vulnerability**: Not validating account relationships.

**Anchor protection**: Use `has_one` and `constraint`.

```rust theme={null}
// Secure
#[account(
    mut,
    has_one = authority,
    constraint = data.count < MAX_COUNT
)]
pub data: Account<'info, MyData>
```

## Arithmetic overflow/underflow

**Vulnerability**: Integer overflow causing unexpected behavior.

**Anchor protection**: Use checked arithmetic.

```rust theme={null}
// Vulnerable
counter.count = counter.count + amount;

// Secure
counter.count = counter.count.checked_add(amount)
    .ok_or(ErrorCode::Overflow)?;
```

## Reinitialization attacks

**Vulnerability**: Allowing accounts to be reinitialized.

**Anchor protection**: `init` constraint prevents reinitialization.

```rust theme={null}
// Secure
#[account(init, payer = user, space = 8 + 8)]
pub data: Account<'info, Data>
```

## PDA validation

**Vulnerability**: Not validating PDA derivation.

**Anchor protection**: Use `seeds` and `bump` constraints.

```rust theme={null}
// Secure
#[account(
    seeds = [b"vault", user.key().as_ref()],
    bump
)]
pub vault: Account<'info, Vault>
```

## Account closing vulnerabilities

**Vulnerability**: Not properly closing accounts or returning lamports to wrong address.

**Anchor protection**: Use `close` constraint.

```rust theme={null}
// Secure
#[account(mut, close = authority)]
pub data: Account<'info, Data>
```

## Duplicate mutable accounts

**Vulnerability**: Same account passed multiple times as mutable.

**Anchor protection**: Anchor prevents duplicate mutable accounts by default (0.32+).

```rust theme={null}
// If intentional, use dup constraint
#[account(mut, dup)]
pub account1: Account<'info, Data>,
#[account(mut)]
pub account2: Account<'info, Data>,
```

## Type confusion

**Vulnerability**: Treating one account type as another.

**Anchor protection**: Account discriminators prevent this.

```rust theme={null}
// Each account type has unique 8-byte discriminator
#[account]
pub struct TypeA { }

#[account]
pub struct TypeB { }
// Cannot deserialize TypeA as TypeB
```

## Best practices checklist

Before deploying:

* [ ] All signers use `Signer<'info>` type
* [ ] All accounts use appropriate Anchor types
* [ ] All account relationships validated with `has_one`
* [ ] All custom logic uses `constraint`
* [ ] Arithmetic uses checked operations
* [ ] PDAs use `seeds` and `bump` constraints
* [ ] Account closes use `close` constraint
* [ ] No `UncheckedAccount` without `/// CHECK:` comment
* [ ] All error cases handled
* [ ] Tests cover security scenarios

## Security audits

For production programs:

1. **Self-audit** using this checklist
2. **Peer review** with experienced Solana developers
3. **Professional audit** from security firms like:
   * OtterSec
   * Sec3
   * Neodyme
   * Trail of Bits

## Learn more

<CardGroup cols={2}>
  <Card title="Sealevel attacks" icon="shield" href="https://github.com/coral-xyz/sealevel-attacks">
    Common Solana vulnerabilities
  </Card>

  <Card title="Security guide" icon="book" href="/guides/security">
    Anchor security patterns
  </Card>
</CardGroup>