Disallow duplicate *mutable* accounts by default#3946
Merged
Conversation
|
@swaroop-osec is attempting to deploy a commit to the Solana Foundation Team on Vercel. A member of the Team first needs to authorize it. |
jamie-osec
reviewed
Sep 16, 2025
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
…_accounts` to prevent validation bypass.
…ccount validation
jacobcreech
approved these changes
Dec 9, 2025
github-project-automation
Bot
moved this from Security Review Done
to Done
in Anchor 1.0
swaroop-osec
added a commit
to swaroop-osec/anchor
that referenced
this pull request
Jan 28, 2026
…ly types that serialize on exit (otter-sec#3946)
swaroop-osec
added a commit
to swaroop-osec/anchor
that referenced
this pull request
Feb 12, 2026
…ly types that serialize on exit (otter-sec#3946)
jamie-osec
pushed a commit
that referenced
this pull request
Feb 12, 2026
* lang: Update duplicate mutable account validation logic to include only types that serialize on exit (#3946) * lang: Update documentation for `dup` constraint * chore: Fix PR link * lang: Update duplicate mutable account constraint to include `Migration` type * lang: Allow duplicates in remaining accounts * fix: use strict AnchorError assertion in nested duplicate test * lang: Introduce `DuplicateMutableAccountKeys` trait for composite account validation
Otter-0x4ka5h
pushed a commit
to Otter-0x4ka5h/anchor
that referenced
this pull request
Mar 25, 2026
* feat: Add duplicate mutable account constraint * feat: tests for duplicate mutable accounts * feat: add test for duplicate mutable accounts in workflow * style(tests): prettier * chore: update benchmarks * feat: exclude UncheckedAccounts from duplicate mutable account checks * feat(tests): add duplicate-mutable-accounts to test scripts * feat: enhance duplicate mutable account checks for optional fields * chore(bench): update * fix: update program IDs * feat: allow duplicate accounts in realloc2 ix * chore(bench): update * chore(bench): update * feat(tests): allow duplicate accounts in misc tests * fix(bench):update * fix: update program ID for duplicate mutable accounts * fix: update program ID * fix(bench): update * chore(docs): Updated docs and CHANGELOG.md * refactor: ignore init accounts * fix(bench): update * chore: formating * refactor: optimize duplicate mutable checks generation * refactor: replace BTreeSet with HashSet * (chore): Update benchmarks * test(events): use confirmOptions for transaction handling * chore: Update CHANGELOG.md * feat(lang): Added checks for duplicate mutable accounts in `remaining_accounts` to prevent validation bypass. * feat(tests): Add nested duplicate account test to prevent mutable account conflicts * chore(bench): Update benchmarks * fix(lang): Exclude Signer accounts from duplicate mutable checks in account validation * feat(tests): Add test to initialize multiple accounts with the same payer * chore(bench): Update * fix: package.json * refactor: remove unused confirmOptions from event tests * chore: update benchmarks * chore: update benchmarks * Update benchmarks * chore: Update benchmarks
Otter-0x4ka5h
pushed a commit
to Otter-0x4ka5h/anchor
that referenced
this pull request
Mar 25, 2026
) * lang: Update duplicate mutable account validation logic to include only types that serialize on exit (otter-sec#3946) * lang: Update documentation for `dup` constraint * chore: Fix PR link * lang: Update duplicate mutable account constraint to include `Migration` type * lang: Allow duplicates in remaining accounts * fix: use strict AnchorError assertion in nested duplicate test * lang: Introduce `DuplicateMutableAccountKeys` trait for composite account validation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3825