◂ labs
TIER 3 · LIFECYCLE & SYSVARS · 10-sysvar-address-checking
SYSVAR ADDRESS CHECKING
Before `sysvar::instructions` became a real syscall, the instruction sysvar was just an account — and attackers passed a fake one to forge instruction introspection. Always pin sysvar accounts to their known addresses.
seen in the wild
Wormhole lost $326M to a forged sysvar account — the largest bridge exploit in crypto started exactly here.
rust · anchor
use anchor_lang::prelude::*;
declare_id!("Fg6PaFpoGXkYsidMpWTK6W2BeZ7FEfcYkg476zPFsLnS");
#[program]
pub mod insecure {
use super::*;
pub fn check_sysvar_address(ctx: Context<CheckSysvarAddress>) -> Result<()> {
msg!("Rent Key -> {}", ctx.accounts.rent.key().to_string());
Ok(())
}
}
#[derive(Accounts)]
pub struct CheckSysvarAddress<'info> {
rent: AccountInfo<'info>,
}