My Solana Program Security Checklist
This is for anyone shipping an Anchor program to mainnet — especially if you're coming from a web2 background and looking for the Solana equivalent of a PR template. Run it top to bottom before every deploy. Every item here came out of a bug I reproduced myself: I wrote adversarial tests that tried to rob my own vault, fuzzed the arithmetic until proptest handed me a counterexample, and rebuilt the exact missing-owner-check bug that drained Wormhole and Cashio. Nothing below is theoretical.
A quick note on how to read this: each item should be answerable with a plain yes or no by someone looking at the code, not a vague reminder to "be careful." If you can't verify an item just by reading the account struct and handler, rewrite it until you can.
Account validation
Every deserialized account has its owner verified. A typed Account<'info, T> does this for you automatically; a raw AccountInfo or UncheckedAccount does not, and manual deserialization off one of those is exactly how Wormhole lost roughly $326M — the program trusted the instructions sysvar without confirming the account's real address, and a forged account deserialized cleanly because nobody checked who owned it.
