Program Patterns Best Practices
Reusable patterns only help when applied consistently. This list captures initialization, custody, state, and upgrade discipline for production Solana programs.
How to Use This List
- Map each instruction to pattern checklist before implementation.
- Cross-link SEEDS.md and state transition tables in reviews.
- Simulate failure paths not only happy paths.
A - Lifecycle
- Separate account creation from initialization; write discriminators before accepting value. Blocks reinit attacks.
- Model business flows as explicit state machines with illegal transition guards. Prevents logic bypass.
- Close accounts by zeroing data and routing rent to a declared recipient. Stops revival.
- Use Clock sysvar for expiries - never trust client-supplied time alone. Honest time source.
- Apply checks-effects-interactions before any external CPI. Reentrancy safety.
B - Custody
- Isolate vault PDAs per user or per escrow with unique seed prefixes. Blast radius control.
- Verify mint, ATA, and authority graph before token CPI. Anti-substitution.
- Collect fees with checked math and capped configurable bps. Economic safety.
- Provide cancel/timeout paths for escrows. User fund safety.
- Minimize admin powers; use multisig and two-step admin transfer. Governance safety.
C - Evolution
- Reserve account space or plan realloc before immutable deploy. Forward compatibility.
- Version schemas and ship migration instructions with upgrades. Live user continuity.
- Document state transition and seed tables for auditors. Faster review.
- Emit events on material state changes for indexers. Operational visibility.
- Regression-test pattern invariants in LiteSVM after every change. Prevent drift.
FAQs
Anchor patterns enough?
Understand macro output still.
One pattern per program?
Combine thoughtfully.
NFT marketplace?
Escrow + metadata checks.
DeFi?
Vault + state machine + oracle.
Game?
State + clock + CU caps.
Immutable?
Patterns 10x important.
Audit order?
Init, custody, admin, CPI.
Surfpool?
Pattern integration tests.
Agave 4.1.1?
Pin and retest.
Docs ADR?
Recommended per pattern choice.
Composable?
Document public CPI surface.
Failure drills?
Sim mainnet failures monthly.
Related
- Program Patterns Basics - Intro
- PDA Best Practices - PDAs
- CPI Best Practices - CPIs
Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.