PDA & Seed Attacks

Program Derived Addresses (PDAs) anchor protocol state to deterministic seeds. Seed and bump mistakes let attackers impersonate vaults, bypass authority checks, or collide with other programs' PDAs.

Recipe

Quick-reference recipe card - copy-paste ready.

// `State::INIT_SPACE` requires `#[account] #[derive(InitSpace)]` on the State struct.
#[account(
    init,
    payer = payer,
    space = 8 + State::INIT_SPACE,
    seeds = [b"state", user.key().as_ref()],
    bump,
)]
pub state: Account<'info, State>,
 
// Store bump on account for later invokes
state.bump = ctx.bumps.state;

When to reach for this:

• Creating vault or escrow PDAs.
• Signing CPIs with invoke_signed.
• Auditing seeds constraints on #[account].
• Migrating seed schemes without orphaning funds.

Working Example

use anchor_lang::prelude::*;
 
#[account]
#[derive(InitSpace)]
pub struct Escrow {
    pub maker: Pubkey,
    pub bump: u8,
}
 
#[derive(Accounts)]
pub struct InitEscrow<'info> {
    #[account(mut)]
    pub maker: Signer<'info>,
 
    #[account(
        init,
        payer = maker,
        space = 8 + Escrow::INIT_SPACE,
        seeds = [b"escrow", maker.key().as_ref()],
        bump,
    )]
    pub escrow: Account<'info, Escrow>,
 
    pub system_program: Program<'info, System>,
}
 
pub fn init_escrow(ctx: Context<InitEscrow>) -> Result<()> {
    ctx.accounts.escrow.maker = ctx.accounts.maker.key();
    ctx.accounts.escrow.bump = ctx.bumps.escrow;
    Ok(())
}

What this demonstrates:

• Seeds include user pubkey - each user gets unique escrow PDA.
• bump in init stores canonical bump for later invoke_signed.
• seeds + bump on subsequent instructions prevent PDA substitution.

Deep Dive

How It Works

• PDAs are off-curve pubkeys derived from (seeds, program_id).
• Runtime finds canonical bump (255 down to 0) where address is off-curve.
• Only the owning program can sign for PDA via invoke_signed with exact seeds.
• Wrong seed sets derive different addresses - attacker supplies lookalike accounts.

Attack Patterns

Rust Notes

let seeds = &[b"escrow", maker.as_ref(), &[escrow.bump]];
let signer_seeds = &[&seeds[..]];
// Pass signer_seeds to CpiContext::new_with_signer

Gotchas

• Bump not stored - Re-searching bump each tx wastes CU and risks mismatch. Fix: Persist bump at init.
• Optional seeds from user - Attacker picks seeds mapping to their account. Fix: Fix protocol prefix bytes; limit user input to pubkeys.
• init_if_needed on PDA - init_if_needed skips creation for an existing account but still runs your handler body; the reset comes from your own unguarded writes, or from close-then-recreate. Fix: Use init once, or guard every field write in the handler.
• Seed UTF-8 confusion - "escrow" vs b"escrow". Fix: Always byte literals b"...".
• Max seed length - Total seeds > 32 bytes per component limit. Fix: Hash long inputs with hashv into 32 bytes.
• PDA as token authority - Must sign token CPI with correct seeds. Fix: Match token account owner to PDA.

Alternatives

FAQs

Related

• Signer & Owner Checks - PDA signing
• Reinitialization Attacks - PDA reinit
• Testing CPIs & PDAs - PDA tests
• Program Derived Addresses - PDA fundamentals

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.