solana-development

What this skill does

# Solana

Everything for building on Solana: developing programs (Anchor or native Rust), auditing them for security, and building with ZK Compression. All three share the same core model - accounts, PDAs, CPIs, tokens - and differ only in abstraction level and goal.

## What this skill covers

| Area | Use when | Jump to |
|------|----------|---------|
| **Development** | Writing programs, tokens, tests, deployments | [Development](#development) |
| **Security & Auditing** | Reviewing for vulnerabilities, writing exploits, audit reports | [Security and Auditing](#security-and-auditing) |
| **ZK Compression** | Rent-free tokens/PDAs at scale via Light Protocol | [ZK Compression](#zk-compression) |

---

# Development

Build Solana programs with Anchor (recommended) or native Rust. Both share accounts, PDAs, CPIs, and tokens; they differ in syntax and abstraction.

## Quick Start

### Recommended: Anchor Framework

Macros and tooling that cut boilerplate and generate TypeScript clients:

```rust
use anchor_lang::prelude::*;

declare_id!("YourProgramID");

#[program]
pub mod my_program {
    use super::*;

    pub fn initialize(ctx: Context<Initialize>, data: u64) -> Result<()> {
        ctx.accounts.account.data = data;
        Ok(())
    }
}

#[derive(Accounts)]
pub struct Initialize<'info> {
    #[account(init, payer = user, space = 8 + 8)]
    pub account: Account<'info, MyAccount>,
    #[account(mut)]
    pub user: Signer<'info>,
    pub system_program: Program<'info, System>,
}

#[account]
pub struct MyAccount {
    pub data: u64,
}
```

```bash
cargo install --git https://github.com/coral-xyz/anchor avm --locked --force
avm install latest && avm use latest
anchor init my_project && cd my_project && anchor build && anchor test
```

**→ See [references/anchor.md](references/anchor.md) for the complete Anchor guide**

### Advanced: Native Rust

Maximum control, optimization potential, and deeper runtime understanding:

```rust
use solana_program::{
    account_info::AccountInfo, entrypoint, entrypoint::ProgramResult,
    pubkey::Pubkey, msg,
};

entrypoint!(process_instruction);

pub fn process_instruction(
    program_id: &Pubkey,
    accounts: &[AccountInfo],
    instruction_data: &[u8],
) -> ProgramResult {
    msg!("Processing instruction");
    // Manual account parsing, validation, and instruction routing
    Ok(())
}
```

```bash
cargo new my_program --lib
cd my_program   # configure Cargo.toml (see native-rust.md)
cargo build-sbf
```

**→ See [references/native-rust.md](references/native-rust.md) for the complete native Rust guide**

## When to use which

| Your need | Approach | Reason |
|-----------|----------|--------|
| Standard DeFi/NFT program | Anchor | Faster, proven patterns |
| TypeScript client needed | Anchor | Auto-generates IDL + types |
| New to Solana | Anchor | Gentler learning curve |
| Compute optimization critical | Native Rust | Direct control, no overhead |
| Smallest program size | Native Rust | No abstraction layer |
| Learning fundamentals | Native Rust | Understand the platform deeply |

You can also start with Anchor for speed, then optimize hot paths with native patterns. Both can coexist in one workspace.

## Reference map

**Foundations**
- [accounts.md](references/accounts.md) - Account model, ownership, rent, validation
- [pda.md](references/pda.md) - Program Derived Addresses: derivation, canonical bumps, signing
- [cpi.md](references/cpi.md) - Cross-Program Invocations safely

**Tokens**
- [tokens-overview.md](references/tokens-overview.md) - Token accounts and ATAs
- [tokens-operations.md](references/tokens-operations.md) - Create, mint, transfer, burn, close
- [tokens-validation.md](references/tokens-validation.md) - Account validation patterns
- [tokens-2022.md](references/tokens-2022.md) - Token Extensions Program
- [tokens-patterns.md](references/tokens-patterns.md) - Common patterns and security

**Testing**
- [testing-overview.md](references/testing-overview.md) - Test pyramid and strategy
- [testing-frameworks.md](references/testing-frameworks.md) - Mollusk, Anchor test, native Rust
- [testing-practices.md](references/testing-practices.md) - Best practices and patterns
- [surfpool.md](references/surfpool.md) - Local dev with mainnet forking, cheatcodes, IaC

**Deployment**
- [deployment.md](references/deployment.md) - Deploy, upgrade, verify, manage programs
- [production-deployment.md](references/production-deployment.md) - Verified builds (Anchor 0.32.1)

**Client**
- [client-development.md](references/client-development.md) - dApp client: wallet connections, React hooks, SOL/SPL transfers, transaction management (framework-kit and @solana/kit 6.x)

**Implementation details**
- [serialization.md](references/serialization.md) - Data layout, Borsh, zero-copy
- [error-handling.md](references/error-handling.md) - Custom errors, propagation, client handling
- [security.md](references/security.md) - Defensive programming patterns during development

**Advanced**
- [compute-optimization.md](references/compute-optimization.md) - CU optimization and benchmarking
- [versioned-transactions.md](references/versioned-transactions.md) - Address Lookup Tables for 256+ accounts
- [durable-nonces.md](references/durable-nonces.md) - Offline signing with durable nonces
- [transaction-lifecycle.md](references/transaction-lifecycle.md) - Submission, retries, confirmations

**Low-level**
- [sysvars.md](references/sysvars.md) - Clock, Rent, EpochSchedule, SlotHashes
- [builtin-programs.md](references/builtin-programs.md) - System Program, Compute Budget Program

## Common tasks

| Task | Pointer |
|------|---------|
| New program | Anchor: `anchor init` / Native: `cargo new --lib` → [anchor.md](references/anchor.md), [native-rust.md](references/native-rust.md) |
| Initialize a PDA | [pda.md](references/pda.md) |
| Transfer SPL tokens | [tokens-operations.md](references/tokens-operations.md) |
| Fast unit tests | Mollusk → [testing-frameworks.md](references/testing-frameworks.md) |
| Local mainnet fork | `surfpool start` → [surfpool.md](references/surfpool.md) |
| Deploy to devnet | [deployment.md](references/deployment.md) |
| Production verified build | `solana-verify build` → [production-deployment.md](references/production-deployment.md) |
| Optimize compute | [compute-optimization.md](references/compute-optimization.md) |
| Handle 40+ accounts | Address Lookup Tables → [versioned-transactions.md](references/versioned-transactions.md) |
| Offline signing | Durable nonces → [durable-nonces.md](references/durable-nonces.md) |

---

# Security and Auditing

Systematic security review for Solana programs (Anchor or native Rust). The core principle: **attackers can pass arbitrary accounts to any instruction**, so there are no implicit guarantees - validate everything, trust nothing.

## Review process

1. **Initial assessment** - Framework (Anchor vs native), Anchor version, dependencies (oracles, external programs), instruction count, account types, program purpose.
2. **Systematic review** - For each instruction, check in order: account validation (signer/owner/writable/init), arithmetic safety (`checked_*`), PDA security (canonical bumps, seed uniqueness), CPI security (validated targets), oracle/external data (staleness, status). → [security-checklists.md](references/security-checklists.md)
3. **Vulnerability pattern detection** - Type cosplay, account reloading, improper closing, missing lamports/ownership checks, PDA substitution, arbitrary CPI, overflow/underflow. → [vulnerability-patterns.md](references/vulnerability-patterns.md)
4. **Architecture and testing review** - PDA design, space/rent, error handling, event emission, compute budget, test coverage (unit/integration/fuzz), upgrade and authority management.
5. **Generate report** - Findings by severity, critical first, quick wins, testing recommendations.

## Essential checks (every instruction)

**Anchor:**
```rust
#[derive(Accounts)]
pub struct SecureInst