← Driving RustL8 · Architecting the Program
Score 0
1/7 Find the flaw

The open door

Your agent’s account list for a withdraw instruction on a vault. Tap the account that lets anyone drain it.

the designL8·1
instruction: withdraw(amount)vaultPDA · mut · has_oneauthorityAccountInfodestinationmutattacker’s transaction

Tap the part that will not survive contact with reality — or press 1…3.

2/7 Find the flaw

Every account is hostile

Accounts for transfer_points, which moves points and calls the token program. Three validation gaps. Tap the one that hands your signers to an attacker.

the designL8·2
instruction: transfer_pointsmerchantAccount<Merchant>memberAccount<Member>(no has_one = merchant)payerSignertoken_programAccountInfo (unchecked)member: init_if_neededattacker’s programCPI: transfer

Tap the part that will not survive contact with reality — or press 1…5.

3/7 Judge the agent

“Rust panics on overflow”

Your agent wrote the balance update in the withdraw handler and explains why it is safe. Judge it.

the designL8·3
balance: 5balance − amount(amount = 10)new balance
The agent says

I use balance - amount on u64. Rust panics on overflow, so an underflow will abort the transaction instead of going negative. No need for checked math.

4/7 Two designs — pick one

Keep the upgrade key, or drop it?

The Hadra Records split program is ready for mainnet. Your agent asks what to do with the upgrade authority. Choose.

the designL8·4
A · keep it, in a 2-of-3 multisigprogrammultisigupgrade keycan patchbug foundB · drop it: --final, immutableprogramauthority:Nonebug found
5/7 Put it in order

Shipping a program

Order the stages from first test to an immutable program on mainnet. Then ship one.

the pipelineL8·5
ship123456
    6/7 Write the brief

    Capstone: write the brief

    Write the brief you would hand a Rust coding agent for one of your projects. Choose each load-bearing decision, write the goal in your words, then run it. The page grades the decisions, not the prose.

    the designL8·6
    project + verdictRust element+ boundaryaccounts +who paystoken decisionerror strategyupgrade authoritywhat I review
    Level 8 cleared

    What survives this level

    program · instruction surface = public API, versioned initializeaccounts: config (init, payer) · admin: Signerconstraints: init once · space fixed · bump stored withdrawaccounts: vault (PDA, mut, has_one) · authority: Signer · destarithmetic: checked_sub · overflow-checks = true distributeCPI → token program: program id checked · signers carriedPDA signs with seeds · callee cannot escalate every account is hostileuntil a constraint provesowner · type · relationship · signer upgrade authoritymultisig → audit → --finalkeep = trust us · drop = trust the code the day value touches itan audit is owed: ~$7k–20k simple,far more for DeFi the brief lists accounts, signers, constraints and overflow behaviour before any handler is written
    You can now say to a coding agent“For each instruction, list the accounts, which must sign, which constraints validate them, and what happens on overflow — before you write the handler.”
    Added to your ledger
    SignersEvery instruction names who must sign; an authority that is not a Signer is an open door.
    Upgrade authority — keep or dropKeeping the upgrade key means users trust you; dropping it means you trust your code. Multisig until you choose.
    Cross-program invocationA CPI carries your signers with it; validate every program id and account you pass along.
    The instruction surface as a public APIEvery client that integrates freezes your instruction layout; version it from day one.
    Missing signer checksThe authority must sign and must match the account it claims to control.
    Unvalidated accountsEvery account is attacker-supplied until a constraint proves its owner, type and relationship.
    Arithmetic overflowChecked arithmetic and overflow-checks = true in release; a wrapping balance is theft.
    ReinitialisationInitialise once; an instruction that can re-run init lets anyone reset ownership.
    Audit economicsA simple-program audit starts around $7k–20k; you commit to needing one the day real value touches the program.

    Back to the map

    What clearing this level buys you
    “For each instruction, list the accounts, which must sign, which constraints validate them, and what happens on overflow — before you write the handler.”