{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/interfaceaccount/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["anchor-lang"],"_cs_severities":["medium"],"_cs_tags":["anchor","solana","interfaceaccount","account-substitution"],"_cs_type":"advisory","_cs_vendors":["Solana Foundation"],"content_html":"\u003cp\u003eA vulnerability exists within the \u003ccode\u003eInterfaceAccount\u003c/code\u003e type in the \u003ccode\u003eanchor-lang\u003c/code\u003e package of the Anchor framework. This flaw allows for the substitution of account types because discriminator checking was unintentionally disabled in pull request #3837. An attacker could potentially exploit this by passing an account of an unexpected type, leading to unexpected behavior in Solana programs. The vulnerability affects version 1.0.0-rc.1. The fix was implemented in pull request #4139 and released in \u003ccode\u003e1.0.0-rc.2\u003c/code\u003e. Users are strongly advised to upgrade to the latest released version of Anchor 1.0 to mitigate this risk. This impacts programs utilizing the Anchor framework on the Solana blockchain.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a Solana program utilizing \u003ccode\u003eInterfaceAccount\u003c/code\u003e with Anchor version 1.0.0-rc.1.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious transaction that attempts to pass an account of an incorrect type to the program via \u003ccode\u003eInterfaceAccount\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe program, lacking discriminator checking due to the vulnerability, accepts the incorrect account.\u003c/li\u003e\n\u003cli\u003eThe program attempts to process the provided account based on the expected type.\u003c/li\u003e\n\u003cli\u003eDue to type mismatch, the program may experience unexpected behavior, such as data corruption.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the corrupted data to manipulate program logic.\u003c/li\u003e\n\u003cli\u003eThe attacker is able to perform unauthorized actions within the Solana program.\u003c/li\u003e\n\u003cli\u003eThis can lead to financial loss, unauthorized data access, or denial of service for other users.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows attackers to substitute account types in Solana programs using the Anchor framework\u0026rsquo;s \u003ccode\u003eInterfaceAccount\u003c/code\u003e, potentially leading to data corruption and unauthorized actions.  This impacts any Solana program using the vulnerable \u003ccode\u003eInterfaceAccount\u003c/code\u003e in \u003ccode\u003eanchor-lang\u003c/code\u003e version 1.0.0-rc.1. Successful exploitation could result in financial loss, data breaches, or denial-of-service for users of the affected Solana programs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to the latest released version of Anchor 1.0 (\u0026gt;= 1.0.0-rc.2) as described in the advisory to patch the vulnerable \u003ccode\u003eInterfaceAccount\u003c/code\u003e type.\u003c/li\u003e\n\u003cli\u003eExamine your Solana programs for uses of \u003ccode\u003eInterfaceAccount\u003c/code\u003e in conjunction with \u003ccode\u003eanchor-lang\u003c/code\u003e 1.0.0-rc.1 and prioritize patching these programs.\u003c/li\u003e\n\u003cli\u003eMonitor Solana program activity for unexpected account interactions and type mismatches as a potential indicator of exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-13T15:36:36Z","date_published":"2026-05-13T15:36:36Z","id":"https://feed.craftedsignal.io/briefs/2026-05-anchor-interfaceaccount-substitution/","summary":"The `InterfaceAccount` in `anchor-lang` allows an unexpected account type to be passed due to disabled discriminator checking, patched in version 1.0.0-rc.2 and later.","title":"Anchor: InterfaceAccount Allows Account Substitution","url":"https://feed.craftedsignal.io/briefs/2026-05-anchor-interfaceaccount-substitution/"}],"language":"en","title":"CraftedSignal Threat Feed — Interfaceaccount","version":"https://jsonfeed.org/version/1.1"}