Skip to content

Conversation

@taasbaba
Copy link
Contributor

@taasbaba taasbaba commented Aug 13, 2025

Description

This PR extends the ImmutableAccountMutatedDetector to cover more mutation patterns that can slip past the current checks, and adds a couple of negative tests to make sure it doesn’t false positive.

Key changes

  1. Added detection for:

    • Two-level dereference with a chained call to try_borrow_mut_lamports()
    • Same as above but with extra parentheses and to_account_info() variant
    • Lamports modification on an UncheckedAccount
    • Calling a method that takes &mut self on an immutable account
  2. Test updates:

    • Added tests for all the above new cases.
    • Added two negative tests to verify no false positives:
      • Local shadow variable (normal struct, not an account)
      • Sysvar, Program, and Signer accounts
    • Added a test for directly replacing an entire account struct — turns out the current detector already catches this, so this was just to confirm.

Verification

  • Ran all tests locally — everything passes.
  • Checked in Extension Development Host — new patterns are flagged as expected, negative tests pass.

Related Tickets & Documents


  • I clicked on "Allow edits from maintainers"

- added tests for lamports zeroing with chained calls and to_account_info()
- added test for replacing whole account struct
- added test for UncheckedAccount lamports change
- added test for calling &mut self methods on immutable accounts
- added two negative tests to avoid false alarms
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add detection for extra immutable account mutation patterns

1 participant