Anchor Basics Best Practices

A clean starting structure for new Anchor 0.32.1 workspaces. Use as a PR checklist for greenfield programs.

How to Use This List

• Apply when scaffolding or reviewing a new program crate.
• Tick items before first devnet deploy.
• Pair with section-specific best-practices lists as you grow features.

A - Workspace

• Pin anchor-lang 0.32.1 in every program Cargo.toml and match Anchor CLI.
• Commit Cargo.lock so CI and teammates build identical artifacts.
• One program per crate under programs/ with clear naming.
• Keep tests in TypeScript for fast client iteration unless Rust tests are required.

B - Program layout

• Group state types near account structs for readable lib.rs modules.
• Name instructions verb-first initialize, deposit, withdraw.
• Use #[error_code] for user-facing failures not raw Err(ProgramError::Custom).
• Emit events for indexable state changes instead of unstructured logs.

C - Security defaults

• Prefer Signer over UncheckedAccount for authorities and payers.
• Validate every PDA with seeds + bump never trust client-supplied bumps alone.
• Avoid init_if_needed unless idempotent by design document reinit risk.
• Close accounts to a defined recipient with close = destination.

D - Shipping

• Run anchor test before every deploy including error path cases.
• anchor keys sync after deploy to prevent ID mismatch.
• Publish IDL with release tags for client codegen.
• Document upgrade authority holder in repo README or ops runbook.

FAQs

Related

• Anchor Basics - examples tour
• The Anchor Workflow - iteration flow
• Accounts & Constraints Best Practices - account hardening

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.

Y29kZWd1aWRlcy5pb3xjZ2lvMzIxfDIwMjYwNw