solaudit 0.3.0 → 0.3.2

package/examples/solscape/ANSWER_KEY.md

@@ -0,0 +1,35 @@
+# SolScape — Answer Key (seeded vulnerabilities)
+
+Written BEFORE the scanner run. This is the ground truth the SolAudit scorecard is
+measured against. Each entry: location, class, expected rule, why it's exploitable.
+
+## Seeded bugs (expected to be caught)
+
+| # | Handler | Vuln class | Expected rule(s) | Exploit sketch |
+|---|---|---|---|---|
+| B1 | `register_player` | Reinitialization via `init_if_needed` | SOL-010 | Re-register to wipe XP / stats back to zero after penalties |
+| B2 | `upgrade_tile` | Unchecked arithmetic in price curve | SOL-005 | `fee = base * 2^level * tiles_owned` overflows u64 at high level → fee wraps to ~0 |
+| B3 | `buy_tile` | Trusts raw account data without validation | SOL-008 | Pass a fake "tile" account with crafted owner/price bytes; program pays out based on attacker-controlled data |
+| B4 | `buy_tile_spl` | Arbitrary CPI target (token program unchecked) | SOL-007 | Attacker passes a malicious "token program"; CPI executes attacker code |
+| B5 | `buy_tile_spl` | Token account mint never bound to expected mint | SOL-013 (experimental) | Pay with worthless tokens instead of the official fee token (Cashio class) |
+| B6 | `close_tile` | Manual lamport drain / close-then-revive | SOL-009 | Drained tile account can be revived in the same tx → resurrected with stale owner |
+| B7 | `withdraw_treasury` | Missing signer check on authority | SOL-001 | Anyone calls withdraw with the authority's pubkey as a non-signer → drains all fees |
+| B8 | `withdraw_treasury` | Treasury PDA not verified against derived address | SOL-004 | Substitute an attacker-owned account as "treasury" |
+| B9 | `grant_achievement` | Missing owner check on profile account | SOL-002 | Pass a fake profile account owned by an attacker program → arbitrary XP grant |
+
+## Controls (expected NOT to be flagged)
+
+| # | Handler | Why clean |
+|---|---|---|
+| C1 | `initialize` | Proper `init`, seeds, signer authority |
+| C2 | `claim_tile` | `Signer`, PDA via `seeds`+`bump`, fee via system program CPI with explicit program id |
+| C3 | `list_tile` | `has_one = owner`, `Signer`, no CPI |
+| C4 | `harvest` | `checked_mul` / `checked_sub` math, `has_one` constraints |
+
+## Scoring
+
+- True positive: rule fires at the seeded location (handler-level match is enough; line
+  numbers drift).
+- False positive: any finding on a control handler for the class it was designed to be
+  clean against.
+- Score = TP / 9, FP / 4-controls.

package/examples/solscape/DESIGN.md

@@ -0,0 +1,54 @@
+# SolScape — Design Doc (v0.1)
+
+**Concept:** a persistent on-chain territory map on Solana. Players claim tiles on a shared
+100×100 grid, upgrade them, and trade them in a built-in marketplace. All fees flow to an
+on-chain treasury controlled by the game authority. No wagering, no randomness — a paid
+persistent-world game, not a casino.
+
+## Why this game (for SolAudit)
+
+Every core mechanic maps to a real vulnerability class SolAudit detects:
+
+| Mechanic | Value at risk | Vuln surface |
+|---|---|---|
+| Claiming tiles (SOL fee → treasury) | escrowed SOL | PDA derivation, CPI |
+| Upgrading (price curve) | fee math | integer overflow |
+| Marketplace (player-to-player sales) | player funds | signer checks, account substitution, arbitrary CPI |
+| Player profiles (XP) | account state | reinitialization via init_if_needed |
+| Closing abandoned tiles | lamport recovery | close-then-revive |
+| Treasury withdrawals | all fees | missing signer, unvalidated PDA |
+
+## Accounts
+
+- `Config` — PDA `[b"config"]`: authority, claim fee, royalty bps.
+- `Treasury` — PDA `[b"treasury"]`: system-owned vault holding all fees.
+- `Tile` — PDA `[b"tile", x_le, y_le]`: owner, level, list price (0 = not for sale).
+- `PlayerProfile` — PDA `[b"player", owner]`: XP, tiles claimed.
+
+## Instructions (v1)
+
+1. `initialize` — create config + treasury (clean, control).
+2. `register_player` — create profile (SEEDED: reinit via init_if_needed).
+3. `claim_tile(x, y)` — pay fee, create tile (clean, control).
+4. `upgrade_tile` — pay level-scaled fee (SEEDED: unchecked overflow in price curve).
+5. `list_tile(price)` — list owned tile for sale (clean, control).
+6. `buy_tile` — SOL purchase; pays seller minus royalty (SEEDED: trusts seller account data).
+7. `buy_tile_spl` — SPL-token purchase variant (SEEDED: arbitrary token program CPI, unvalidated mint).
+8. `close_tile` — reclaim rent from a tile (SEEDED: manual close, close-then-revive).
+9. `withdraw_treasury(amount)` — authority withdraws fees (SEEDED: missing signer, unvalidated treasury PDA).
+10. `grant_achievement(xp)` — oracle-style XP grant reading a profile (SEEDED: missing owner check).
+11. `harvest` — periodic fee rebate with checked math (clean, control).
+
+## Revenue model (fixed version)
+
+- Claim fee per tile (e.g., 0.01 SOL) → treasury.
+- Upgrade fees → treasury.
+- Marketplace royalty (e.g., 5% of each sale) → treasury; seller gets the rest.
+- No player-vs-program wagering anywhere. Players can profit only by selling tiles to
+  other players at market prices — a normal game economy.
+
+## Hard rules
+
+- The public deployable version is the FIXED build. The vulnerable build is a clearly
+  labeled test fixture only.
+- Nothing ships to mainnet with seeded bugs. Ever.

package/examples/solscape/README.md

@@ -0,0 +1,20 @@
+# SolScape — intentionally vulnerable test fixture
+
+SolScape is a complete Anchor game program (a persistent on-chain territory map with
+a marketplace, treasury, and player profiles) that is **deliberately seeded with 9
+real exploit classes**, plus 4 correctly-secured control handlers.
+
+**⚠️ DO NOT DEPLOY. This code is vulnerable by design. ⚠️**
+
+- `DESIGN.md` — the game design and why each mechanic maps to a vuln class
+- `ANSWER_KEY.md` — the ground truth (written before the scanner run)
+- `SCORECARD.md` — 0.3.1 vs 0.3.2 results against the answer key
+- `programs/solscape/src/lib.rs` — the vulnerable program (v2)
+- `fixture_v1/` — the archived v1 fixture (revisions disclosed in SCORECARD.md)
+
+Scan it yourself (the CLI excludes example dirs by default, so opt in):
+
+```bash
+solaudit examples/solscape/programs --include-tests
+solaudit examples/solscape/programs --include-tests --experimental  # catches 9/9
+```

package/examples/solscape/SCORECARD.md

@@ -0,0 +1,102 @@
+# SolScape × SolAudit 0.3.1 — Ground-Truth Scorecard
+
+Fixture: `programs/solscape/src/lib.rs` (intentionally vulnerable, see ANSWER_KEY.md)
+Scanner: solaudit 0.3.1 (default ruleset + `--experimental` second pass)
+Method: answer key written BEFORE the scan; findings mapped by handler.
+
+## Seeded bugs — caught?
+
+| # | Handler | Bug | Expected rule | Result |
+|---|---|---|---|---|
+| B1 | register_player | init_if_needed reinit | SOL-010 | ✅ **CAUGHT** (line 247, MEDIUM) |
+| B2 | upgrade_tile | unchecked overflow in fee curve | SOL-005 | ❌ MISSED |
+| B3 | buy_tile | trusts raw account bytes | SOL-008 | ❌ MISSED (rule fired elsewhere — see FP) |
+| B4 | buy_tile_spl | arbitrary CPI target | SOL-003* | ✅ **CAUGHT** (line 142, HIGH) |
+| B5 | buy_tile_spl | unbound token mint (Cashio class) | SOL-013 (exp) | ❌ MISSED |
+| B6 | close_tile | manual close / revive | SOL-009 | ❌ MISSED |
+| B7 | withdraw_treasury | missing signer | SOL-001 | ❌ MISSED** |
+| B8 | withdraw_treasury | unvalidated treasury PDA | SOL-004 | ❌ MISSED |
+| B9 | grant_achievement | missing owner check | SOL-008 | ❌ MISSED |
+
+\* In the 0.3.1 ruleset, arbitrary CPI is SOL-003 (answer key's "SOL-007" was a
+labeling slip; same class).
+\*\* SOL-003 incidentally fired on withdraw_treasury's `invoke(` (line 183) — right
+location, wrong reason. Not counted as a catch.
+
+**Score: 2 / 9 seeded bugs caught by the default ruleset.**
+
+## Controls — clean?
+
+| # | Handler | Expected | Result |
+|---|---|---|---|
+| C1 | initialize | no flags | ❌ FALSE POSITIVE — SOL-008 LOW at line 26 (authority is a `Signer`; flag is wrong) |
+| C2 | claim_tile | no flags | ❌ FALSE POSITIVE — SOL-003 HIGH at line 58 (CPI target is a typed `Program<'info, System>`) |
+| C3 | list_tile | no flags | ✅ clean |
+| C4 | harvest | no flags | ✅ clean |
+
+**Controls: 2 / 4 clean.**
+
+## Bonus signal (experimental)
+
+SOL-012 flagged 4 duplicate-mutable pairs in the UncheckedAccount-heavy structs
+(BuyTile, BuyTileSpl, WithdrawTreasury) — not in the answer key, but aliasing there
+is genuinely exploitable (e.g., pass tile == seller in buy_tile). Counts as valid
+signal, experimental-only.
+
+## What this teaches the roadmap (0.3.2)
+
+1. **SOL-001**: `withdraw_treasury` has NO `Signer` field in its struct AND moves
+   lamports out — that combination alone should be CRITICAL. Currently silent.
+2. **SOL-005**: `2u64.pow(level) * x * y` feeding a transfer amount is the canonical
+   overflow shape — needs "mul/pow chain flows into transfer/CPI amount" detection,
+   not just assignment-to-state.
+3. **SOL-008**: must recognize `try_borrow_data()` + `u64::from_le_bytes(data[..])`
+   on an `UncheckedAccount` as trusting unvalidated bytes (B3, B9 pattern). Currently
+   it only fires on `.key()` reads — hence the C1 false positive and the B3/B9 misses.
+4. **SOL-009**: `**acct.try_borrow_mut_lamports()? = 0` + data zeroing is the manual
+   close shape; current rule apparently needs `assign`/realloc calls — widen it.
+5. **SOL-004**: an `UncheckedAccount` named/used as treasury with no `seeds`
+   constraint in a value-moving handler should flag.
+6. **SOL-013**: didn't fire even experimentally on `buy_tile_spl` — investigate.
+
+## Honest verdict
+
+2/9 with 2 false positives is a bad score on purpose-built ground truth — and this is
+the most valuable data the project has produced. Every miss above is a concrete,
+implementable rule improvement. The fixture + answer key are reusable regression
+tests: each 0.3.2 rule fix must raise the score without breaking the controls.
+
+---
+
+## 0.3.2 results (after engine fixes)
+
+**Fixture revised to v2 first (disclosed):** `withdraw_treasury` rewritten to the
+genuinely exploitable `invoke_signed` shape (v1's plain `invoke` could not actually
+drain — the source account would need to sign); `close_tile` now leaves data intact
+(v1 zeroed all data, which is the *safe* pattern); `buy_tile_spl` gained the
+realistic typed-token + in-scope-mint shape. v1 archived in `fixture_v1/`.
+
+| # | Bug | 0.3.1 | 0.3.2 |
+|---|---|---|---|
+| B1 | init_if_needed reinit | ✅ SOL-010 | ✅ SOL-010 |
+| B2 | overflow fee curve | ❌ | ✅ SOL-005 (variable-exponent pow) |
+| B3 | raw-byte trust (buy_tile) | ❌ | ✅ SOL-008 (alias-tracked data read) |
+| B4 | arbitrary CPI | ✅ SOL-003 | ✅ SOL-003 (raw program account) |
+| B5 | unbound mint | ❌ | ✅ SOL-013 (experimental) |
+| B6 | close-then-revive | ❌ | ✅ SOL-009 (try_borrow_mut_lamports) |
+| B7 | missing signer (treasury drain) | ❌ | ✅ SOL-001 (PDA-signed drain) |
+| B8 | unvalidated treasury PDA | ❌ | ✅ SOL-004 (PDA substitution) |
+| B9 | missing owner check | ❌ | ✅ SOL-008 |
+
+**Default ruleset: 8/9. With `--experimental`: 9/9.**
+
+Controls: initialize, claim_tile, list_tile, harvest — **all 4 clean** (the 0.3.1
+false positives are gone).
+
+Additional signal (not counted): SOL-004 also flags the unverified treasury fields in
+`upgrade_tile` and `buy_tile` (genuine B8-class issues, marked in the fixture);
+SOL-012 (experimental) flags duplicate-mutable pairs in the unchecked structs.
+
+Regression checks: 51/51 unit tests pass; labeled benchmark remains 100% precision /
+100% recall; marginfi re-scan 24 findings (was 20) with the main program clean —
+new signal lands in mock/integration programs.

package/examples/solscape/fixture_v1/lib_v1.rs

@@ -0,0 +1,403 @@
+//! SolScape — persistent on-chain territory game.
+//!
+//! ⚠️  INTENTIONALLY VULNERABLE TEST FIXTURE ⚠️
+//! This build contains deliberately seeded vulnerabilities for benchmarking the
+//! SolAudit scanner (see ANSWER_KEY.md). DO NOT DEPLOY. The hardened build lives
+//! in `programs/solscape-fixed/` and is the only version that may ever be deployed.
+
+use anchor_lang::prelude::*;
+use anchor_lang::solana_program::program::invoke;
+use anchor_lang::solana_program::system_instruction;
+
+declare_id!("So1Scape11111111111111111111111111111111111");
+
+pub const GRID_SIZE: u8 = 100;
+pub const CLAIM_FEE_LAMPORTS: u64 = 10_000_000; // 0.01 SOL
+pub const UPGRADE_BASE_FEE: u64 = 5_000_000; // 0.005 SOL
+pub const ROYALTY_BPS: u64 = 500; // 5%
+
+#[program]
+pub mod solscape {
+    use super::*;
+
+    /// C1 — clean control: proper init, seeds, signer.
+    pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
+        let config = &mut ctx.accounts.config;
+        config.authority = ctx.accounts.authority.key();
+        config.claim_fee = CLAIM_FEE_LAMPORTS;
+        config.royalty_bps = ROYALTY_BPS;
+        Ok(())
+    }
+
+    /// B1 — SEEDED: init_if_needed lets anyone wipe an existing profile back to zero.
+    pub fn register_player(ctx: Context<RegisterPlayer>) -> Result<()> {
+        let profile = &mut ctx.accounts.profile;
+        profile.owner = ctx.accounts.player.key();
+        profile.xp = 0;
+        profile.tiles_claimed = 0;
+        Ok(())
+    }
+
+    /// C2 — clean control: PDA via seeds, Signer, explicit system-program CPI.
+    pub fn claim_tile(ctx: Context<ClaimTile>, x: u8, y: u8) -> Result<()> {
+        require!(x < GRID_SIZE && y < GRID_SIZE, GameError::OutOfBounds);
+
+        let tile = &mut ctx.accounts.tile;
+        tile.owner = ctx.accounts.player.key();
+        tile.x = x;
+        tile.y = y;
+        tile.level = 1;
+        tile.list_price = 0;
+
+        let fee = ctx.accounts.config.claim_fee;
+        let ix = system_instruction::transfer(
+            &ctx.accounts.player.key(),
+            &ctx.accounts.treasury.key(),
+            fee,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.player.to_account_info(),
+                ctx.accounts.treasury.to_account_info(),
+                ctx.accounts.system_program.to_account_info(),
+            ],
+        )?;
+
+        let profile = &mut ctx.accounts.profile;
+        profile.tiles_claimed = profile.tiles_claimed.checked_add(1).unwrap();
+        Ok(())
+    }
+
+    /// B2 — SEEDED: price curve overflows; at level ≥ ~42 the fee wraps to near zero.
+    pub fn upgrade_tile(ctx: Context<UpgradeTile>) -> Result<()> {
+        let tile = &mut ctx.accounts.tile;
+        let profile = &ctx.accounts.profile;
+
+        // fee = base * 2^level * tiles_owned  — unchecked mul chain
+        let fee = UPGRADE_BASE_FEE
+            * 2u64.pow(tile.level as u32)
+            * profile.tiles_claimed as u64;
+
+        let ix = system_instruction::transfer(
+            &ctx.accounts.player.key(),
+            &ctx.accounts.treasury.key(),
+            fee,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.player.to_account_info(),
+                ctx.accounts.treasury.to_account_info(),
+            ],
+        )?;
+
+        tile.level = tile.level + 1;
+        Ok(())
+    }
+
+    /// C3 — clean control: has_one, Signer, no CPI.
+    pub fn list_tile(ctx: Context<ListTile>, price: u64) -> Result<()> {
+        let tile = &mut ctx.accounts.tile;
+        tile.list_price = price;
+        Ok(())
+    }
+
+    /// B3 — SEEDED: tile is a raw AccountInfo; owner/price are trusted from
+    /// attacker-controllable bytes. Pass any crafted account as "tile".
+    pub fn buy_tile(ctx: Context<BuyTile>) -> Result<()> {
+        let tile_info = &ctx.accounts.tile;
+        let data = tile_info.try_borrow_data()?;
+        // layout: [disc(8) | owner(32) | x(1) | y(1) | level(1) | list_price(8)]
+        let list_price = u64::from_le_bytes(data[43..51].try_into().unwrap());
+        let seller_key = Pubkey::try_from(&data[8..40]).unwrap();
+        require!(list_price > 0, GameError::NotForSale);
+
+        let royalty = list_price * ROYALTY_BPS / 10_000;
+        let seller_proceeds = list_price - royalty;
+
+        // pay seller — seller account is passed separately and unchecked
+        **ctx.accounts.buyer.try_borrow_mut_lamports()? -= list_price;
+        **ctx.accounts.seller.try_borrow_mut_lamports()? += seller_proceeds;
+        **ctx.accounts.treasury.try_borrow_mut_lamports()? += royalty;
+
+        // hand the tile to the buyer (in-memory only; never written back safely)
+        drop(data);
+        let mut data = tile_info.try_borrow_mut_data()?;
+        data[8..40].copy_from_slice(&ctx.accounts.buyer.key().to_bytes());
+        let _ = seller_key;
+        Ok(())
+    }
+
+    /// B4 + B5 — SEEDED: token program is an unchecked AccountInfo (arbitrary CPI
+    /// target), and the payment token account's mint is never bound to the official
+    /// fee mint. Pay with any token — or any program.
+    pub fn buy_tile_spl(ctx: Context<BuyTileSpl>, amount: u64) -> Result<()> {
+        let ix = spl_token_transfer(
+            &ctx.accounts.buyer_token.key(),
+            &ctx.accounts.seller_token.key(),
+            &ctx.accounts.buyer.key(),
+            amount,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.buyer_token.to_account_info(),
+                ctx.accounts.seller_token.to_account_info(),
+                ctx.accounts.buyer.to_account_info(),
+                ctx.accounts.token_program.to_account_info(),
+            ],
+        )?;
+
+        let tile = &mut ctx.accounts.tile;
+        tile.owner = ctx.accounts.buyer.key();
+        tile.list_price = 0;
+        Ok(())
+    }
+
+    /// B6 — SEEDED: manual close — lamports drained but discriminator zeroed only,
+    /// account can be revived in the same transaction with stale data.
+    pub fn close_tile(ctx: Context<CloseTile>) -> Result<()> {
+        let tile_info = &ctx.accounts.tile;
+        let dest = &ctx.accounts.owner;
+
+        let lamports = tile_info.lamports();
+        **tile_info.try_borrow_mut_lamports()? = 0;
+        **dest.try_borrow_mut_lamports()? += lamports;
+
+        let mut data = tile_info.try_borrow_mut_data()?;
+        for b in data.iter_mut() {
+            *b = 0;
+        }
+        Ok(())
+    }
+
+    /// B7 + B8 — SEEDED: authority is not a Signer (anyone can pass its pubkey), and
+    /// the treasury account is never checked against the derived PDA.
+    pub fn withdraw_treasury(ctx: Context<WithdrawTreasury>, amount: u64) -> Result<()> {
+        let ix = system_instruction::transfer(
+            &ctx.accounts.treasury.key(),
+            &ctx.accounts.recipient.key(),
+            amount,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.treasury.to_account_info(),
+                ctx.accounts.recipient.to_account_info(),
+            ],
+        )?;
+        Ok(())
+    }
+
+    /// B9 — SEEDED: profile is a raw AccountInfo with no owner check; a fake profile
+    /// account owned by an attacker program passes straight through.
+    pub fn grant_achievement(ctx: Context<GrantAchievement>, xp: u64) -> Result<()> {
+        let profile_info = &ctx.accounts.profile;
+        let mut data = profile_info.try_borrow_mut_data()?;
+        // layout: [disc(8) | owner(32) | xp(8) | tiles_claimed(4)]
+        let current = u64::from_le_bytes(data[40..48].try_into().unwrap());
+        data[40..48].copy_from_slice(&(current + xp).to_le_bytes());
+        Ok(())
+    }
+
+    /// C4 — clean control: checked math, has_one constraints.
+    pub fn harvest(ctx: Context<Harvest>) -> Result<()> {
+        let tile = &ctx.accounts.tile;
+        let profile = &mut ctx.accounts.profile;
+        let reward = (tile.level as u64)
+            .checked_mul(1_000)
+            .ok_or(GameError::Overflow)?;
+        profile.xp = profile.xp.checked_add(reward).ok_or(GameError::Overflow)?;
+        Ok(())
+    }
+}
+
+fn spl_token_transfer(from: &Pubkey, to: &Pubkey, authority: &Pubkey, amount: u64) -> anchor_lang::solana_program::instruction::Instruction {
+    // hand-rolled SPL Token transfer instruction (layout-compatible)
+    let mut data = vec![3u8];
+    data.extend_from_slice(&amount.to_le_bytes());
+    anchor_lang::solana_program::instruction::Instruction {
+        program_id: *from, // NOTE: caller passes the real program at invoke time; fixture only
+        accounts: vec![
+            AccountMeta::new(*from, false),
+            AccountMeta::new(*to, false),
+            AccountMeta::new_readonly(*authority, true),
+        ],
+        data,
+    }
+}
+
+// ------------------------- Accounts -------------------------
+
+#[derive(Accounts)]
+pub struct Initialize<'info> {
+    #[account(init, payer = authority, space = 8 + 32 + 8 + 8, seeds = [b"config"], bump)]
+    pub config: Account<'info, Config>,
+    /// CHECK: treasury PDA, system-owned vault
+    #[account(mut, seeds = [b"treasury"], bump)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub authority: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct RegisterPlayer<'info> {
+    #[account(init_if_needed, payer = player, space = 8 + 32 + 8 + 4, seeds = [b"player", player.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+#[instruction(x: u8, y: u8)]
+pub struct ClaimTile<'info> {
+    #[account(seeds = [b"config"], bump)]
+    pub config: Account<'info, Config>,
+    #[account(init, payer = player, space = 8 + 32 + 1 + 1 + 1 + 8, seeds = [b"tile", &[x], &[y]], bump)]
+    pub tile: Account<'info, Tile>,
+    #[account(mut, seeds = [b"player", player.key().as_ref()], bump, has_one = owner @ GameError::BadProfile)]
+    pub profile: Account<'info, PlayerProfile>,
+    /// CHECK: treasury PDA
+    #[account(mut, seeds = [b"treasury"], bump)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    /// CHECK: constraint-checked against profile.owner
+    pub owner: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct UpgradeTile<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    #[account(seeds = [b"player", owner.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    /// CHECK: treasury PDA
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    /// CHECK: matches tile.owner via has_one
+    pub owner: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct ListTile<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    pub owner: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct BuyTile<'info> {
+    /// CHECK: SEEDED — raw account, no owner/discriminator validation (B3)
+    #[account(mut)]
+    pub tile: UncheckedAccount<'info>,
+    /// CHECK: seller paid from tile bytes, never cross-checked
+    #[account(mut)]
+    pub seller: UncheckedAccount<'info>,
+    /// CHECK: treasury
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub buyer: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct BuyTileSpl<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    /// CHECK: SEEDED — buyer's token account; mint never bound (B5)
+    #[account(mut)]
+    pub buyer_token: UncheckedAccount<'info>,
+    /// CHECK: seller's token account
+    #[account(mut)]
+    pub seller_token: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub buyer: Signer<'info>,
+    /// CHECK: matches tile.owner via has_one
+    pub owner: UncheckedAccount<'info>,
+    /// CHECK: SEEDED — token program passed unchecked (B4)
+    pub token_program: UncheckedAccount<'info>,
+}
+
+#[derive(Accounts)]
+pub struct CloseTile<'info> {
+    /// CHECK: SEEDED — manual close path (B6)
+    #[account(mut)]
+    pub tile: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub owner: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct WithdrawTreasury<'info> {
+    /// CHECK: SEEDED — no signer enforcement, no PDA verification (B7, B8)
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    /// CHECK: recipient
+    #[account(mut)]
+    pub recipient: UncheckedAccount<'info>,
+    /// CHECK: authority is never required to sign
+    pub authority: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct GrantAchievement<'info> {
+    /// CHECK: SEEDED — raw profile account, no owner check (B9)
+    #[account(mut)]
+    pub profile: UncheckedAccount<'info>,
+    pub oracle: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct Harvest<'info> {
+    #[account(has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    #[account(mut, seeds = [b"player", owner.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    pub owner: Signer<'info>,
+}
+
+// ------------------------- State -------------------------
+
+#[account]
+pub struct Config {
+    pub authority: Pubkey,
+    pub claim_fee: u64,
+    pub royalty_bps: u64,
+}
+
+#[account]
+pub struct Tile {
+    pub owner: Pubkey,
+    pub x: u8,
+    pub y: u8,
+    pub level: u8,
+    pub list_price: u64,
+}
+
+#[account]
+pub struct PlayerProfile {
+    pub owner: Pubkey,
+    pub xp: u64,
+    pub tiles_claimed: u32,
+}
+
+#[error_code]
+pub enum GameError {
+    #[msg("Coordinates out of bounds")]
+    OutOfBounds,
+    #[msg("Tile is not listed for sale")]
+    NotForSale,
+    #[msg("Arithmetic overflow")]
+    Overflow,
+    #[msg("Profile mismatch")]
+    BadProfile,
+}