Verify account data matches expected values for permission operations

Always verify is_signer flag before checking pubkey

Validate accounts are owned by expected programs

Implement two-step authority transfers with confirmation

Restrict initialization to authorized deployers only

Validate all accounts in security dependency chains

Prevent account type substitution attacks with discriminators

Handle realloc zero_init parameter correctly to prevent stale data

Always use canonical bumps for PDAs, never accept user-provided bumps

Zero data and set closed discriminator when closing accounts

Prevent same account from being passed twice as different parameters

Use unique seeds for each user and functionality to prevent PDA collisions

Validate all accounts used as PDA seeds to prevent substitution attacks

Manually validate all accounts passed via ctx.remaining_accounts

Use unique constant prefixes for each PDA type to prevent collisions

Reload accounts after CPIs that modify them

Always validate CPI target program IDs before invocation

Never forward user wallet signers to untrusted CPI targets

Multiply before dividing and use correct rounding direction

Use checked arithmetic for all value calculations

Use try_from for narrowing type conversions

Always validate divisors are non-zero before division

Use token_interface::transfer_checked for Token-2022 support

Validate token account owner and mint fields to prevent substitution attacks

Support delegation flow for CPIGuard-enabled accounts

Check account frozen state after initialization

Reject or carefully handle closable mints to prevent reinitialization attacks

Reject mints with permanent delegate to protect vault funds

Validate mint, transferring flag, and token accounts in transfer hooks

Calculate actual received amounts after transfer fees

Handle pending balance counter DoS for confidential transfer accounts

Require users to specify expected values to prevent sandwich attacks

Use vec![value; count] not vec![count] to create N-element vectors

Use pull pattern or validate recipients for lamport transfers

Use init_if_needed instead of init for Associated Token Accounts

Always use ? operator on Result-returning functions

Validate sysvar addresses or use direct access methods

Avoid unsafe code; if necessary, document and minimize scope

Validate account identity beyond just address when referencing closeable accounts

Revalidate account ownership on every use of saved references

Limit iterations, avoid cloning, use fixed-size arrays in loops

Do CPIs before lamport changes, or pass affected accounts to CPI

Minimize constraints; allow program-owned and PDA recipients

Validate program ID, enforce inline mode, and check all Ed25519 instruction fields

Include expiry, user binding, and replay protection in signed metadata