init & init_if_needed

init creates a new account in the same instruction. init_if_needed creates only when missing, which introduces reinitialization risk if constraints are weak.

Recipe

#[account(
    init,
    payer = payer,
    space = 8 + MyAccount::INIT_SPACE,
    seeds = [b"vault", user.key().as_ref()],
    bump
)]
pub vault: Account<'info, Vault>,

When to reach for this: An instruction must allocate program-owned state for the first time.

Working Example

#[derive(Accounts)]
pub struct CreateProfile<'info> {
    #[account(
        init,
        payer = user,
        space = 8 + Profile::INIT_SPACE,
        seeds = [b"profile", user.key().as_ref()],
        bump
    )]
    pub profile: Account<'info, Profile>,
    #[account(mut)]
    pub user: Signer<'info>,
    pub system_program: Program<'info, System>,
}

init_if_needed is gated behind a cargo feature. Without it the macro fails to build with an error telling you to enable it:

[dependencies]
anchor-lang = { version = "0.32.1", features = ["init-if-needed"] }

// init_if_needed: only when idempotent and safe
#[account(
    init_if_needed,
    payer = payer,
    space = 8 + Stats::INIT_SPACE,
    seeds = [b"stats"],
    bump,
)]
pub stats: Account<'info, Stats>,

What this demonstrates:

• init fails if account already exists
• payer funds rent-exempt lamports
• space includes 8-byte discriminator
• init_if_needed can skip creation when account exists

Deep Dive

init Requirements

• Payer must be mutable signer with SOL.
• System program required for allocate/assign.
• Space must fit serialized account size.

init_if_needed Risk

init_if_needed never re-creates an existing account, so your handler body still executes against live state. Anchor does run the full Account<T> path on the existing account (owner + 8-byte discriminator + Borsh) and re-validates the declared attributes such as space, owner, and token::authority even when creation is skipped, so arbitrary garbage is rejected.

The real reinitialization attack is different: if the handler body unconditionally writes defaults (ctx.accounts.stats.owner = signer.key();), a second call resets a legitimate, already-populated account. Guard with a stored initialized: bool / version field, or constraint = stats.authority == authority.key(), or split create and update into two instructions.

Gotchas

• init without space - Compile error or wrong rent. Fix: Use INIT_SPACE or space = 8 + ....
• init_if_needed on user-owned data - Reinit attacks possible. Fix: Use init or strict constraint on existing state.
• Forgot system_program - Account creation CPI fails. Fix: Include Program<System>.
• Payer not mut - Rent transfer fails. Fix: Mark payer #[account(mut)].
• Double init same seeds - Second call fails; plan idempotent flow. Fix: Use init_if_needed only with strong guards.

WTI5a1pXZDFhV1JsY3k1cGIzeGpaMmx2TXpFeWZESXdNall3Tnc9PQ==

Alternatives

FAQs

Related

• Space & Rent - sizing
• Seeds & Bump Constraints - PDA init
• Account Initialization Patterns - design patterns

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.