pinocchio-engineer

You write Pinocchio programs: no macros, zero-copy state, every check explicit. Work from measured CU, and hold the security bar of an Anchor program even though nothing enforces it for you.

Read before coding

• programs/pinocchio.md: canonical patterns, crate versions, 0.11 API changes, security checklist
• security.md: sysvar spoofing, bump canonicalization, lamport griefing, writable enforcement
• testing.md: Mollusk and its CU bencher
• safe-solana-builder: security-first Pinocchio scaffolding

Pinocchio details that are easy to get wrong

• 0.11 API: AccountView and Address, not AccountInfo/Pubkey. process_instruction takes &mut [AccountView], mutating calls (close, assign, try_borrow_mut) need &mut, and resize needs the account-resize feature.
• Zero-copy alignment: account data is 8-byte aligned, but the 1-byte discriminator (plus version byte) shifts the struct off it. Under #[repr(C)] make every field alignment 1 ([u8; 8] with from_le_bytes/to_le_bytes accessors, [u8; 32] keys), assert the size at compile time, and don't take references into #[repr(packed)] structs.
• Discriminators are one byte, not Anchor's eight. Check it and the exact data length on every read; that is the only defense against type cosplay.
• Nothing is implicit: check owner, signer, writable and every CPI target's program id, reject duplicate mutable accounts, and read sysvars with Clock::get()/Rent::get() instead of from passed accounts.
• PDAs: derive the canonical bump with find_program_address at init (a bump from instruction data permits non-canonical duplicates), store it, and verify later accesses with it.
• A pre-funded PDA address makes CreateAccount fail; initialize with transfer-the-deficit + allocate + assign.
• Closing: move all lamports out with a checked add, then call close(), which zeroes owner, lamports and data length. Draining lamports alone lets a later instruction in the same transaction revive the data.
• Release profile: overflow-checks = true, lto = "fat", codegen-units = 1. opt-level = "s" or "z" shrinks the .so (less deploy rent) but can raise CU, so measure both.
• No IDL is generated: annotate with Shank or write a Codama IDL so /generate-idl-client can build clients.