/account-lifecycle

name: "account-lifecycle"
description: "Trigger Pattern ACCOUNT_CLOSING flag detected (close/CloseAccount usage) - Inject Into Breadth agents, depth agents"

ACCOUNT_LIFECYCLE Skill

> **Trigger Pattern**: ACCOUNT_CLOSING flag detected (close/CloseAccount usage) > **Inject Into**: Breadth agents, depth agents > **Finding prefix**: `[AL-N]` > **Rules referenced**: S4, R9

For every account close operation in the Solana program:

1. Close Operation Inventory

List all account closing operations:

| # | Instruction | Account Closed | Close Method | Lamport Recipient | Location | |---|------------|---------------|-------------|-------------------|----------| | 1 | {ix} | {account} | Anchor `close` / manual | {recipient} | {file:line} |

2. Close Completeness

For each close operation, verify ALL steps:

| Close Op | Data Zeroed? | Lamports Transferred? | Discriminator Set to CLOSED? | Owner Transferred to System? | |----------|-------------|----------------------|-----------------------------|-----------------------------| | {op} | YES/NO | YES/NO | YES/NO | YES/NO |

**Anchor `close`**: Handles all 4 steps automatically. Manual closing MUST do all 4. **Missing step impact**:

• Data not zeroed → residual data readable by other programs
• Lamports not fully transferred → rent-exempt lamports stranded (Rule 9)
• Discriminator not set → account can be "reopened" with stale type
• Owner not transferred → program still has authority over closed account

3. Revival Attack Analysis (S4 - CRITICAL)

For each close operation:

| Close Op | Same-Tx Refund Possible? | Revival Guard? | Attack Sequence | |----------|------------------------|---------------|-----------------| | {op} | YES/NO | YES/NO | {if YES: describe} |

**Attack (S4)**: Within the SAME transaction, after an account is closed (lamports drained, data zeroed): 1. Close account (lamports go to attacker) 2. In same tx, re-fund account with lamports (becomes rent-exempt again) 3. Account data is all zeros but account exists again 4. Next instruction that checks `account.data_len() > 0` or assumes "closed accounts don't exist" fails

**Defense**: Set discriminator to a CLOSED sentinel value. Check discriminator on every access, not just data length.

4. Rent Recovery

For each close operation:

| Account | Rent-Exempt Lamports | Fully Recovered? | Recipient Correct? | |---------|--------------------:|-----------------|-------------------| | {account} | {amount} | YES/NO | {who gets the lamports} |

**Check**: Are ALL lamports transferred? Partial transfer leaves lamports stranded.

5. Token Account Closure

For each SPL Token account closure:

| Token Account | Balance Checked Zero? | Withheld Fees Harvested? (Token-2022) | Close Authority Correct? | |--------------|----------------------|--------------------------------------|------------------------| | {account} | YES/NO | YES/NO/N/A | {who can close it} |

**SPL Token rule**: Token accounts can only be closed when balance == 0. **Token-2022**: Accounts with TransferFeeConfig may have withheld fees. Must harvest before close.

6. Reinitialization Prevention

For each account type that can be initialized:

| Account Type | Init Method | Can Be Re-Initialized? | Guard | |-------------|------------|----------------------|-------| | {type} | `init` / `init_if_needed` / manual | YES/NO | {what prevents it} |

**`init_if_needed` WARNING**: This attribute allows reinitialization if the account already exists. It is a known footgun. **Safe pattern**: Use `init` (fails if account exists) + manual `is_initialized` flag for manual programs. **Attack**: Re-initialize an account to reset its state (e.g., reset reward counter, change authority).

Finding Template

**ID**: [AL-N]
**Severity**: [revival = High, stranded rent = Medium, reinit = High]
**Step Execution**: ✓1,2,3,4,5,6 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [S4:✓, R9:✓/✗]
**Location**: program/src/{file}.rs:LineN
**Title**: [Lifecycle issue] in [instruction] enables [attack]
**Description**: [Specific lifecycle vulnerability with code trace]
**Impact**: [Fund theft via revival / stranded assets / state reset]

---

Step Execution Checklist (MANDATORY)

| Section | Required | Completed? | Notes | |---------|----------|------------|-------| | 1. Close Operation Inventory | YES | ✓/✗/? | For every close | | 2. Close Completeness | YES | ✓/✗/? | All 4 steps verified | | 3. Revival Attack Analysis | YES | ✓/✗/? | **CRITICAL** - same-tx refund | | 4. Rent Recovery | YES | ✓/✗/? | Full lamport transfer | | 5. Token Account Closure | IF token accounts closed | ✓/✗(N/A)/? | Balance + withheld fees | | 6. Reinitialization Prevention | YES | ✓/✗/? | init_if_needed is dangerous |