Solana program security checklist
Account validation
For every account, ask who owns it, whether it should be a signer, whether it's the PDA you think it is, and whether it's initialised. In Anchor, express these as typed accounts and constraints (Signer, Account<T>, seeds/bump, has_one).
Arithmetic
Use checked math (checked_add and friends) or enable overflow checks in release builds.
CPI safety
Verify the program ID you invoke, and only sign with PDA seeds for the exact call that needs them.
Closing and re-initialisation
Close accounts with Anchor's close constraint, and be careful with init_if_needed.
Oracles
Check feed identity, staleness and confidence before acting on a price.
Reviews and references
Study public audit findings and the Solana security courses before mainnet.
Commands and APIs change, so the official Solana docs and Anchor docs are the source of truth.