Security Checklist for Solana Developers

Solana's account model creates unique security considerations. Use this checklist to ensure your programs are secure against common attack vectors.

Solana Developer78 items Updated May 17, 2026

0 of 78 complete (0%)

Account Validation

Verify account owner matches expected program IDcritical

Check account discriminator to ensure correct account typecritical

Validate signer status for accounts that should authorize actionscritical

Check writable flag for accounts that will be modifiedcritical

Verify account is initialized before reading datacritical

Validate account data length matches expected sizecritical

Check that accounts are not closed (lamports = 0)critical

Verify rent-exempt status for accounts that should persistimportant

PDA Security

Use consistent seeds for PDA derivation across program and clientcritical

Store bump seed in account data to avoid recalculationcritical

Validate PDA derivation on-chain, don't trust client-provided PDAscritical

Use create_program_address for validation, not find_program_addressimportant

Include unique identifiers in seeds to prevent collisionscritical

Document seed structure clearly for maintainabilityimportant

Use canonical bump (the one from find_program_address)critical

Keep total seed length under 32 bytesimportant

Token Operations

Verify token account mint matches expected tokencritical

Check token account owner is the expected user/PDAcritical

Validate token program ID (SPL Token vs Token-2022)critical

Account for token decimals in all calculationscritical

Check token account is not frozen before transfersimportant

Verify associated token account derivationcritical

Handle close authority properly for token accountsimportant

Check delegate and delegated amount for token accountsimportant

Arithmetic Safety

Use checked arithmetic (checked_add, checked_sub, checked_mul)critical

Handle division by zero explicitlycritical

Consider precision loss in division operationscritical

Round in protocol's favor, not user's favorcritical

Use saturating arithmetic where appropriateimportant

Validate numeric inputs are within expected rangescritical

Use fixed-point math for financial calculationscritical

Test edge cases with minimum and maximum valuescritical

CPI Security

Validate target program ID before CPIcritical

Use hardcoded program IDs, not account-provided onescritical

Pass correct signer seeds for PDA-signed CPIscritical

Follow checks-effects-interactions patterncritical

Update state before making CPIs to prevent reentrancycritical

Check CPI return values for successcritical

Limit CPIs to known, audited programscritical

Document CPI trust assumptionsimportant

Access Control

Implement proper authority checks for admin functionscritical

Use multi-sig or governance for critical operationscritical

Implement upgrade authority controlscritical

Add timelock for sensitive parameter changesimportant

Document all privileged operationsimportant

Allow authority transfer/revocationimportant

Validate authority accounts are signerscritical

Consider program freezing for emergenciesimportant

State Management

Initialize all account fields explicitlycritical

Use proper serialization/deserializationcritical

Handle account resizing carefullyimportant

Clean up closed accounts properlyimportant

Prevent duplicate initializationcritical

Use version field for future migrationsimportant

Validate state transitions are validcritical

Document account lifecycleimportant

Clock and Timing

Use Clock sysvar for timestamps, not block datacritical

Handle i64 timestamps correctly (not u64)important

Consider slot vs Unix timestamp based on precision needsimportant

Account for clock skew in time-sensitive operationsimportant

Don't trust future timestamps from userscritical

Implement reasonable timelock durationsimportant

Testing

Write detailed unit tests with Bankruncritical

Test on devnet with realistic conditionscritical

Test all error paths, not just happy pathscritical

Use fuzzing (Trident) for complex logicimportant

Test with invalid account inputscritical

Test arithmetic edge casescritical

Test CPI failure scenariosimportant

Verify compute unit usage under loadimportant

Deployment

Verify program builds are reproduciblecritical

Use verified builds on-chainimportant

Store upgrade authority securely (multi-sig)critical

Test upgrade procedure before mainnetcritical

Document deployment and upgrade processimportant

Consider making program immutable after stabilizationimportant

Monitor program after deploymentcritical

Have incident response plan readycritical

Pro Tips

Account validation is the most common source of Solana vulnerabilities. Check every account constraint.

Test with the exact version of the Solana CLI you will deploy with.

Use Anchor constraints (has_one, constraint) instead of manual checks.

More for Solana Developer

Solana Program Deployment Checklist 50 Portfolio Project Ideas for Solana Developers 30 Common Mistakes Solana Developers Make (And How to Avoid Them)30 Essential Tools for Solana Developers

Ready to build your Web3 career?

Browse hundreds of open roles across the decentralized ecosystem.

Explore Jobs

Back to resources