solaudit 0.3.1 → 0.3.2

package/README.md

@@ -55,7 +55,7 @@ $ solaudit ./examples
 ```
 
 ```
-SolAudit v0.3.1 — static analysis for Anchor/Solana programs
+SolAudit v0.3.2 — static analysis for Anchor/Solana programs
 Scanned 1 file(s) at 2026-08-27T06:00:00.000Z
 ──────────────────────────────────────────────────────────────────────
 
@@ -96,15 +96,15 @@ bun run dev
 
 | ID | Severity | Name | What it catches |
 |---|---|---|---|
-| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls with no signer evidence anywhere: no nearby `is_signer` check, no `Signer<'info>` field on the governing Accounts struct, and no PDA signing (`invoke_signed` / `new_with_signer`) |
+| `SOL-001` | CRITICAL | Missing Signer Check | `transfer`/`mint_to` calls with no signer evidence anywhere: no nearby `is_signer` check, no `Signer<'info>` field on the governing Accounts struct, and no PDA signing (`invoke_signed` / `new_with_signer`). Also flags PDA-signed transfers whose *destination* is a caller-supplied unchecked account with no `Signer` governing the instruction (the classic vault drain) |
 | `SOL-002` | HIGH | Unchecked Account Deserialization | `Account::try_from` / `AccountLoader::try_from` on an account with no validating `#[account(...)]` constraint (constraint-aware: fields carrying `owner`/`constraint`/`has_one` bindings are recognized as validated) |
-| `SOL-003` | HIGH | Arbitrary CPI | `invoke`/`invoke_signed` targeting a program ID sourced from a caller-supplied account instead of a verified constant |
-| `SOL-004` | HIGH | Missing Bump Seed Canonicalization | `create_program_address` called directly with a bump that didn't come from a nearby `find_program_address` (which is canonical by construction) |
-| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic *written into account state* (field/compound assignment) on balance-like values instead of `checked_*`/`saturating_*` |
+| `SOL-003` | HIGH | Arbitrary CPI | `invoke`/`invoke_signed` whose program ID comes from a raw (unchecked) program account (`program_id: ctx.accounts.*` or a raw `*_program` field); typed `Program<'info, T>` targets are recognized as safe |
+| `SOL-004` | HIGH | Missing Bump Seed Canonicalization / Unverified PDA | `create_program_address` called directly with a bump that didn't come from a nearby `find_program_address` (which is canonical by construction); also raw, mutable vault/treasury/pool-style accounts used in value movement with no `seeds`/`address` binding |
+| `SOL-005` | MEDIUM | Integer Overflow Risk | Raw `+`/`-`/`*` arithmetic *written into account state* (field/compound assignment) on balance-like values instead of `checked_*`/`saturating_*`; also variable-exponent `pow()` in value math (e.g. `2u64.pow(level)` in a fee curve) |
 | `SOL-006` | HIGH | Type Cosplay / Missing Discriminator Check | Manual `try_from_slice` deserialization with no discriminator validation or `Account<'info, T>` wrapper |
 | `SOL-007` | MEDIUM | Insecure Account Initialization | `#[account(init, ...)]` constraints missing `payer` and/or `space` |
-| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo`/`UncheckedAccount` fields with no constraint binding whose data is trusted (deserialized/read) or whose key is assigned into persistent state, with no `.owner` check anywhere in the file |
-| `SOL-009` | HIGH | Insecure Manual Account Closure | An account's lamports manually drained to zero without discriminator zeroing or owner reassignment (unlike Anchor's `close = destination`), enabling closed-account revival |
+| `SOL-008` | LOW | Missing Owner Check | Raw `AccountInfo`/`UncheckedAccount` fields with no constraint binding whose data is trusted (deserialized/read, including through `let x = &ctx.accounts.f` aliases) or whose key is assigned into persistent state, with no genuine `.owner ==` comparison; usages are scoped to the owning struct's handlers |
+| `SOL-009` | HIGH | Insecure Manual Account Closure | An account's lamports manually drained to zero (`lamports.borrow_mut() = 0` or `try_borrow_mut_lamports() = 0`) without discriminator zeroing or owner reassignment (unlike Anchor's `close = destination`), enabling closed-account revival |
 | `SOL-010` | MEDIUM | Reinitialization Risk via init_if_needed | `#[account(init_if_needed, ...)]` without canonical PDA seeds / `has_one` constraints, letting a pre-existing attacker-crafted account pass as freshly initialized |
 | `SOL-011` | MEDIUM | Missing Rent-Exemption Check | A partial lamport withdrawal with no nearby `Rent::get()?.minimum_balance(...)` check, risking runtime garbage-collection of the account |
 
@@ -124,6 +124,17 @@ On the committed labeled suite in [`benchmark/`](./benchmark), the deterministic
 
 Benchmark label integrity note: three samples' labels were revised in 0.3.1 to match SOL-008's sharpened definition (raw accounts whose *data* is trusted or whose key is *assigned into state*); each revision is documented inline in [`benchmark/labels.json`](./benchmark/labels.json).
 
+### Ground-truth validation (0.3.2): SolScape
+
+0.3.1 was measured against **purpose-built ground truth**: [SolScape](https://github.com/blueeyez425-art/solaudit/tree/main/examples/solscape), a complete (intentionally vulnerable) Anchor game program — a persistent on-chain territory map with a marketplace, treasury, and player profiles — seeded with 9 real exploit classes (missing-signer treasury drain, unchecked PDA substitution, overflow price curve, arbitrary CPI, unbound token mint, close-then-revive, raw-byte trust, reinitialization) plus 4 correctly-secured control handlers. The answer key was written **before** the scan.
+
+- **0.3.1 caught 2 of 9 seeded bugs** and false-flagged 2 of 4 controls. We published that scorecard, then fixed the engine.
+- **0.3.2 catches 8 of 9 by default, 9 of 9 with `--experimental`** (the unbound-mint class is SOL-013), with **all 4 controls clean**.
+- Fixes: SOL-001 now detects PDA-signed transfers to caller-chosen unchecked recipients when no `Signer` governs the instruction (the classic vault drain); SOL-003 only flags CPIs whose *program* is a raw account (typed `Program<'info, T>` no longer flags); SOL-004 also flags unseeds-verified vault/treasury/pool accounts used in value movement; SOL-005 catches variable-exponent `pow()` in value math; SOL-008 follows `let x = &ctx.accounts.f` aliases, scopes usages to the owning struct's handlers, and no longer mistakes `field.owner = ...` assignments for checks; SOL-009 recognizes `try_borrow_mut_lamports() = 0` manual closes.
+- marginfi re-scan sanity check: 24 findings (was 20) — the main program stays clean; the new signal lands in mock/integration programs.
+
+Fixture revisions disclosed: SolScape's `withdraw_treasury` was rewritten to the genuinely exploitable `invoke_signed` shape (v1's plain `invoke` could not actually drain), `close_tile` now leaves data intact (v1 zeroed it, which is the *safe* pattern), and `buy_tile_spl` gained the realistic typed-token + mint shape SOL-013 is designed to scope to. v1 is archived in the fixture directory.
+
 **Duplicate mutable accounts** and **token accounts unbound to their mint** (the Cashio class) are covered by the experimental `SOL-012` and `SOL-013` rules, available via `solaudit --experimental`. A “distinctness” heuristic false-positives on common legitimate patterns (for example a deposit instruction’s user/vault token accounts of the same type with no explicit `!=` constraint), so it stays opt-in to protect the default ruleset's precision. These numbers describe this suite, not general security effectiveness.
 
 ## Output formats (CLI)

package/dist/cli.js

@@ -264,10 +264,23 @@ var missingSignerCheck = {
       const hasSignerEvidence = /is_signer/.test(window) || /Signer<\s*'info\s*>/.test(window) || /#\[account\([^)]*signer[^)]*\)\]/i.test(window);
       if (hasSignerEvidence)
         return;
+      const struct = structAt(model, offset);
       const extWindow = lines.slice(windowStart, Math.min(lines.length, idx + 16)).join(`
 `);
-      if (/\binvoke_signed\b/.test(extWindow))
+      if (/\binvoke_signed\b/.test(extWindow)) {
+        if (struct && !struct.fields.some((f) => f.isSignerTyped)) {
+          const callBlock = lines.slice(idx, Math.min(lines.length, idx + 8)).join(`
+`);
+          if (/system_instruction::transfer|::transfer(?:_checked)?\s*\(/.test(callBlock)) {
+            const refs = [...callBlock.matchAll(/ctx\.accounts\.(\w+)/g)].map((m) => m[1]);
+            const toField = refs.length >= 2 ? findField(model, refs[1]) : null;
+            if (toField && toField.isRaw && !toField.validated) {
+              findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, rawLine, `This instruction PDA-signs a transfer whose destination (\`${refs[1]}\`) is a caller-supplied unchecked account, and its Accounts struct has no Signer — anyone can call it and drain the vault. Require an authority Signer and bind the recipient to validated state.`));
+            }
+          }
+        }
         return;
+      }
       if (/\bnew_with_signer\b/.test(extWindow))
         return;
       if (/system_instruction::transfer/.test(line) && /\binvoke(?:_signed)?\s*\(/.test(extWindow)) {
@@ -281,7 +294,6 @@ var missingSignerCheck = {
         if (prevLines.some((l) => /\binvoke(?:_signed)?\s*\([^)]*$/.test(l)))
           return;
       }
-      const struct = structAt(model, offset);
       if (struct && struct.fields.some((f) => f.isSignerTyped))
         return;
       findings.push(makeFinding(missingSignerCheck, filePath, idx + 1, rawLine, "Verify the authority/owner account is a Signer or explicitly check `.is_signer` before transferring or minting tokens."));
@@ -329,17 +341,35 @@ var arbitraryCpi = {
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const cpiPattern = /\b(invoke|invoke_signed)\s*\(/;
+    const cpiPattern = /\b(?:invoke|invoke_signed)\s*\(/;
+    const model = getConstraintModel(fileContent);
     lines.forEach((line, idx) => {
       if (!cpiPattern.test(line))
         return;
-      const windowStart = Math.max(0, idx - 3);
-      const windowEnd = Math.min(lines.length, idx + 4);
-      const window = lines.slice(windowStart, windowEnd).join(`
-`);
-      const usesAccountsAsProgram = /ctx\.accounts\.\w+\.(to_account_info\(\)|key\(\))/.test(window) && !/Program<\s*'info/.test(window);
-      if (usesAccountsAsProgram) {
+      const offset = lineOffset(lines, idx);
+      if (inRanges(offset, model.testRanges))
+        return;
+      const windowStart = Math.max(0, idx - 12);
+      const windowEnd = Math.min(lines.length, idx + 12);
+      const window = stripLineComments(lines.slice(windowStart, windowEnd).join(`
+`));
+      const suspectNames = new Set;
+      for (const m of window.matchAll(/program_id\s*:\s*[*&]?\s*(?:ctx\.accounts\.)?(\w+)/g)) {
+        suspectNames.add(m[1]);
+      }
+      for (const m of window.matchAll(/ctx\.accounts\.(\w*(?:^|_)program\w*)/g)) {
+        suspectNames.add(m[1]);
+      }
+      for (const name of suspectNames) {
+        const field = findField(model, name);
+        if (field && field.wrapperType === "Program")
+          continue;
+        if (field && !field.isRaw)
+          continue;
+        if (!field && /Program<\s*'info/.test(window))
+          continue;
         findings.push(makeFinding(arbitraryCpi, filePath, idx + 1, line, "Validate the target program ID against a known constant (e.g. `token_program.key() == spl_token::ID`) or type the account as `Program<'info, T>` before invoking it."));
+        break;
       }
     });
     return findings;
@@ -368,6 +398,44 @@ var missingBumpCanonicalization = {
         return;
       findings.push(makeFinding(missingBumpCanonicalization, filePath, idx + 1, line, "Use `Pubkey::find_program_address` to derive the canonical bump instead of calling `create_program_address` directly with a caller-supplied bump."));
     });
+    if (model.structs.length > 0) {
+      const offsets = [];
+      let acc = 0;
+      for (const l of lines) {
+        offsets.push(acc);
+        acc += l.length + 1;
+      }
+      for (const s of model.structs) {
+        const regions = model.regions.filter((r) => r.contextType === s.name);
+        const regionText = regions.length > 0 ? regions.map((r) => fileContent.slice(r.start, r.end)).join(`
+`) : fileContent;
+        const movesValue = /system_instruction::transfer|token::transfer|try_borrow_mut_lamports|lamports\.borrow_mut/.test(stripLineComments(regionText));
+        if (!movesValue)
+          continue;
+        const inScope = (lineIdx) => {
+          if (regions.length === 0)
+            return true;
+          const off = offsets[lineIdx];
+          return regions.some((r) => off >= r.start && off < r.end);
+        };
+        for (const f of s.fields) {
+          if (!f.isRaw || f.validated)
+            continue;
+          if (!/\bmut\b/.test(f.attrs))
+            continue;
+          if (!/vault|treasury|pool|escrow|fund|bank|reward/i.test(f.name))
+            continue;
+          for (let i = 0;i < lines.length; i++) {
+            if (!inScope(i))
+              continue;
+            if (!lines[i].includes(`ctx.accounts.${f.name}`))
+              continue;
+            findings.push(makeFinding(missingBumpCanonicalization, filePath, i + 1, lines[i], `\`${f.name}\` is a mutable unchecked account used in value movement with no \`seeds\` binding. Verify it against its derived PDA (\`seeds = [...], bump\`) or pin it with \`address =\` — otherwise the caller can substitute an attacker-controlled account and redirect the funds.`));
+            break;
+          }
+        }
+      }
+    }
     return findings;
   }
 };
@@ -399,6 +467,9 @@ var integerOverflowRisk = {
       if (arithmeticPattern.test(code) && stateWritePattern.test(code)) {
         findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Replace raw arithmetic written to state with `.checked_add()/.checked_sub()/.checked_mul()` (propagating errors via `ok_or(ErrorCode::MathOverflow)?`) or `saturating_*` equivalents."));
       }
+      if (/\.pow\s*\([^)]*[a-zA-Z_]/.test(code) && !/checked_pow|saturating|wrapping/.test(code)) {
+        findings.push(makeFinding(integerOverflowRisk, filePath, idx + 1, line, "Exponentiation with a non-constant exponent overflows silently and quickly (2^64 wraps a u64 to 0). Use `checked_pow` with error propagation, or bound the exponent explicitly."));
+      }
     });
     return findings;
   }
@@ -462,53 +533,55 @@ var missingOwnerCheck = {
     const lines = splitLines(fileContent);
     const model = getConstraintModel(fileContent);
     if (model.structs.length > 0) {
-      const validatedNames = new Set;
-      for (const s of model.structs) {
-        for (const f of s.fields) {
-          if (f.validated)
-            validatedNames.add(f.name);
+      const codeOnly = stripLineComments(fileContent);
+      const offsets = [];
+      {
+        let off = 0;
+        for (const l of lines) {
+          offsets.push(off);
+          off += l.length + 1;
         }
       }
-      const suspects = new Map;
+      const touchPattern = /try_borrow_data|try_borrow_mut_data|try_borrow_mut_lamports|\.load\s*\(|data\.borrow|try_from|\.lamports\s*\(\s*\)|accessor::/;
       for (const s of model.structs) {
+        const regions = model.regions.filter((r) => r.contextType === s.name);
+        const inScope = (lineIdx) => {
+          if (regions.length === 0)
+            return true;
+          const off = offsets[lineIdx];
+          return regions.some((r) => off >= r.start && off < r.end);
+        };
         for (const f of s.fields) {
-          if (!f.isRaw || validatedNames.has(f.name))
+          if (!f.isRaw || f.validated)
             continue;
-          if (new RegExp(`\\b${f.name}\\s*\\.owner\\b`).test(stripLineComments(fileContent))) {
+          const ownerCheck = new RegExp(`\\b${f.name}\\.owner\\s*==|require!\\([^)]*\\b${f.name}\\.owner\\b|require_keys_eq!\\([^)]*\\b${f.name}\\b`);
+          if (ownerCheck.test(codeOnly))
             continue;
+          const aliases = new Set;
+          const aliasRe = new RegExp(`let\\s+(\\w+)\\s*=\\s*&?\\s*ctx\\.accounts\\.${f.name}\\b`, "g");
+          let am;
+          while ((am = aliasRe.exec(codeOnly)) !== null)
+            aliases.add(am[1]);
+          let reportLine = -1;
+          let snippet = "";
+          for (let i = 0;i < lines.length; i++) {
+            if (!inScope(i))
+              continue;
+            const l = lines[i];
+            const direct = l.includes(`ctx.accounts.${f.name}`);
+            const aliasTouch = [...aliases].some((a) => new RegExp(`\\b${a}\\s*\\.`).test(l) && touchPattern.test(l));
+            const directTouch = direct && touchPattern.test(l);
+            const keyAssign = direct && new RegExp(`=\\s*&?\\s*ctx\\.accounts\\.${f.name}\\.key\\s*\\(`).test(l) && !/==|require_keys_eq/.test(l);
+            if (aliasTouch || directTouch || keyAssign) {
+              reportLine = i + 1;
+              snippet = l;
+              break;
+            }
           }
-          if (!suspects.has(f.name))
-            suspects.set(f.name, f.line);
-        }
-      }
-      for (const [name, declLine] of suspects) {
-        const usagePattern = new RegExp(`ctx\\.accounts\\.${name}\\b`);
-        let reportLine = declLine;
-        let snippet = lines[declLine - 1] || name;
-        let touchesData = false;
-        for (let i = 0;i < lines.length; i++) {
-          if (!usagePattern.test(lines[i]) || i + 1 === declLine)
+          if (reportLine === -1)
             continue;
-          if (reportLine === declLine) {
-            reportLine = i + 1;
-            snippet = lines[i];
-          }
-          if (/try_borrow_data|\.load\s*\(|data\.borrow|try_from|\.lamports\s*\(|accessor::/.test(lines[i])) {
-            touchesData = true;
-            reportLine = i + 1;
-            snippet = lines[i];
-          }
-          if (new RegExp(`=\\s*(?:&)?ctx\\.accounts\\.${name}\\.key\\s*\\(`).test(lines[i]) && !/==|require_keys_eq/.test(lines[i])) {
-            touchesData = true;
-            reportLine = i + 1;
-            snippet = lines[i];
-          }
+          findings.push(makeFinding(missingOwnerCheck, filePath, reportLine, snippet, `\`${f.name}\` is a raw AccountInfo with no constraint binding. Add an explicit \`require!(ctx.accounts.${f.name}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check (or an \`#[account(owner = ...)]\` constraint) before trusting its data.`));
         }
-        if (reportLine === declLine)
-          continue;
-        if (!touchesData)
-          continue;
-        findings.push(makeFinding(missingOwnerCheck, filePath, reportLine, snippet, `\`${name}\` is a raw AccountInfo with no constraint binding. Add an explicit \`require!(ctx.accounts.${name}.owner == &expected_program_id, ErrorCode::InvalidOwner)\` check (or an \`#[account(owner = ...)]\` constraint) before trusting its data.`));
       }
       return findings;
     }
@@ -551,7 +624,7 @@ var insecureAccountClosure = {
   check(fileContent, filePath) {
     const findings = [];
     const lines = splitLines(fileContent);
-    const zeroLamportsPattern = /\.lamports\.borrow_mut\(\)\s*=\s*0\s*;/;
+    const zeroLamportsPattern = /(?:\.lamports\.borrow_mut\(\)|\.try_borrow_mut_lamports\(\)\??)\s*=\s*0\s*;/;
     lines.forEach((line, idx) => {
       if (!zeroLamportsPattern.test(line))
         return;
@@ -843,7 +916,7 @@ function badge(severity) {
 var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
 function printReport(result) {
   const timestamp = new Date().toISOString();
-  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.1 — static analysis for Anchor/Solana programs${RESET}`);
+  console.log(`${BOLD}${CYAN}SolAudit${RESET} ${DIM}v0.3.2 — static analysis for Anchor/Solana programs${RESET}`);
   console.log(`${DIM}Scanned ${result.scannedFiles} file(s) at ${timestamp}${RESET}`);
   console.log(`${GRAY}${"─".repeat(70)}${RESET}`);
   if (result.findings.length === 0) {

package/examples/solscape/ANSWER_KEY.md

@@ -0,0 +1,35 @@
+# SolScape — Answer Key (seeded vulnerabilities)
+
+Written BEFORE the scanner run. This is the ground truth the SolAudit scorecard is
+measured against. Each entry: location, class, expected rule, why it's exploitable.
+
+## Seeded bugs (expected to be caught)
+
+| # | Handler | Vuln class | Expected rule(s) | Exploit sketch |
+|---|---|---|---|---|
+| B1 | `register_player` | Reinitialization via `init_if_needed` | SOL-010 | Re-register to wipe XP / stats back to zero after penalties |
+| B2 | `upgrade_tile` | Unchecked arithmetic in price curve | SOL-005 | `fee = base * 2^level * tiles_owned` overflows u64 at high level → fee wraps to ~0 |
+| B3 | `buy_tile` | Trusts raw account data without validation | SOL-008 | Pass a fake "tile" account with crafted owner/price bytes; program pays out based on attacker-controlled data |
+| B4 | `buy_tile_spl` | Arbitrary CPI target (token program unchecked) | SOL-007 | Attacker passes a malicious "token program"; CPI executes attacker code |
+| B5 | `buy_tile_spl` | Token account mint never bound to expected mint | SOL-013 (experimental) | Pay with worthless tokens instead of the official fee token (Cashio class) |
+| B6 | `close_tile` | Manual lamport drain / close-then-revive | SOL-009 | Drained tile account can be revived in the same tx → resurrected with stale owner |
+| B7 | `withdraw_treasury` | Missing signer check on authority | SOL-001 | Anyone calls withdraw with the authority's pubkey as a non-signer → drains all fees |
+| B8 | `withdraw_treasury` | Treasury PDA not verified against derived address | SOL-004 | Substitute an attacker-owned account as "treasury" |
+| B9 | `grant_achievement` | Missing owner check on profile account | SOL-002 | Pass a fake profile account owned by an attacker program → arbitrary XP grant |
+
+## Controls (expected NOT to be flagged)
+
+| # | Handler | Why clean |
+|---|---|---|
+| C1 | `initialize` | Proper `init`, seeds, signer authority |
+| C2 | `claim_tile` | `Signer`, PDA via `seeds`+`bump`, fee via system program CPI with explicit program id |
+| C3 | `list_tile` | `has_one = owner`, `Signer`, no CPI |
+| C4 | `harvest` | `checked_mul` / `checked_sub` math, `has_one` constraints |
+
+## Scoring
+
+- True positive: rule fires at the seeded location (handler-level match is enough; line
+  numbers drift).
+- False positive: any finding on a control handler for the class it was designed to be
+  clean against.
+- Score = TP / 9, FP / 4-controls.

package/examples/solscape/DESIGN.md

@@ -0,0 +1,54 @@
+# SolScape — Design Doc (v0.1)
+
+**Concept:** a persistent on-chain territory map on Solana. Players claim tiles on a shared
+100×100 grid, upgrade them, and trade them in a built-in marketplace. All fees flow to an
+on-chain treasury controlled by the game authority. No wagering, no randomness — a paid
+persistent-world game, not a casino.
+
+## Why this game (for SolAudit)
+
+Every core mechanic maps to a real vulnerability class SolAudit detects:
+
+| Mechanic | Value at risk | Vuln surface |
+|---|---|---|
+| Claiming tiles (SOL fee → treasury) | escrowed SOL | PDA derivation, CPI |
+| Upgrading (price curve) | fee math | integer overflow |
+| Marketplace (player-to-player sales) | player funds | signer checks, account substitution, arbitrary CPI |
+| Player profiles (XP) | account state | reinitialization via init_if_needed |
+| Closing abandoned tiles | lamport recovery | close-then-revive |
+| Treasury withdrawals | all fees | missing signer, unvalidated PDA |
+
+## Accounts
+
+- `Config` — PDA `[b"config"]`: authority, claim fee, royalty bps.
+- `Treasury` — PDA `[b"treasury"]`: system-owned vault holding all fees.
+- `Tile` — PDA `[b"tile", x_le, y_le]`: owner, level, list price (0 = not for sale).
+- `PlayerProfile` — PDA `[b"player", owner]`: XP, tiles claimed.
+
+## Instructions (v1)
+
+1. `initialize` — create config + treasury (clean, control).
+2. `register_player` — create profile (SEEDED: reinit via init_if_needed).
+3. `claim_tile(x, y)` — pay fee, create tile (clean, control).
+4. `upgrade_tile` — pay level-scaled fee (SEEDED: unchecked overflow in price curve).
+5. `list_tile(price)` — list owned tile for sale (clean, control).
+6. `buy_tile` — SOL purchase; pays seller minus royalty (SEEDED: trusts seller account data).
+7. `buy_tile_spl` — SPL-token purchase variant (SEEDED: arbitrary token program CPI, unvalidated mint).
+8. `close_tile` — reclaim rent from a tile (SEEDED: manual close, close-then-revive).
+9. `withdraw_treasury(amount)` — authority withdraws fees (SEEDED: missing signer, unvalidated treasury PDA).
+10. `grant_achievement(xp)` — oracle-style XP grant reading a profile (SEEDED: missing owner check).
+11. `harvest` — periodic fee rebate with checked math (clean, control).
+
+## Revenue model (fixed version)
+
+- Claim fee per tile (e.g., 0.01 SOL) → treasury.
+- Upgrade fees → treasury.
+- Marketplace royalty (e.g., 5% of each sale) → treasury; seller gets the rest.
+- No player-vs-program wagering anywhere. Players can profit only by selling tiles to
+  other players at market prices — a normal game economy.
+
+## Hard rules
+
+- The public deployable version is the FIXED build. The vulnerable build is a clearly
+  labeled test fixture only.
+- Nothing ships to mainnet with seeded bugs. Ever.

package/examples/solscape/README.md

@@ -0,0 +1,20 @@
+# SolScape — intentionally vulnerable test fixture
+
+SolScape is a complete Anchor game program (a persistent on-chain territory map with
+a marketplace, treasury, and player profiles) that is **deliberately seeded with 9
+real exploit classes**, plus 4 correctly-secured control handlers.
+
+**⚠️ DO NOT DEPLOY. This code is vulnerable by design. ⚠️**
+
+- `DESIGN.md` — the game design and why each mechanic maps to a vuln class
+- `ANSWER_KEY.md` — the ground truth (written before the scanner run)
+- `SCORECARD.md` — 0.3.1 vs 0.3.2 results against the answer key
+- `programs/solscape/src/lib.rs` — the vulnerable program (v2)
+- `fixture_v1/` — the archived v1 fixture (revisions disclosed in SCORECARD.md)
+
+Scan it yourself (the CLI excludes example dirs by default, so opt in):
+
+```bash
+solaudit examples/solscape/programs --include-tests
+solaudit examples/solscape/programs --include-tests --experimental  # catches 9/9
+```

package/examples/solscape/SCORECARD.md

@@ -0,0 +1,102 @@
+# SolScape × SolAudit 0.3.1 — Ground-Truth Scorecard
+
+Fixture: `programs/solscape/src/lib.rs` (intentionally vulnerable, see ANSWER_KEY.md)
+Scanner: solaudit 0.3.1 (default ruleset + `--experimental` second pass)
+Method: answer key written BEFORE the scan; findings mapped by handler.
+
+## Seeded bugs — caught?
+
+| # | Handler | Bug | Expected rule | Result |
+|---|---|---|---|---|
+| B1 | register_player | init_if_needed reinit | SOL-010 | ✅ **CAUGHT** (line 247, MEDIUM) |
+| B2 | upgrade_tile | unchecked overflow in fee curve | SOL-005 | ❌ MISSED |
+| B3 | buy_tile | trusts raw account bytes | SOL-008 | ❌ MISSED (rule fired elsewhere — see FP) |
+| B4 | buy_tile_spl | arbitrary CPI target | SOL-003* | ✅ **CAUGHT** (line 142, HIGH) |
+| B5 | buy_tile_spl | unbound token mint (Cashio class) | SOL-013 (exp) | ❌ MISSED |
+| B6 | close_tile | manual close / revive | SOL-009 | ❌ MISSED |
+| B7 | withdraw_treasury | missing signer | SOL-001 | ❌ MISSED** |
+| B8 | withdraw_treasury | unvalidated treasury PDA | SOL-004 | ❌ MISSED |
+| B9 | grant_achievement | missing owner check | SOL-008 | ❌ MISSED |
+
+\* In the 0.3.1 ruleset, arbitrary CPI is SOL-003 (answer key's "SOL-007" was a
+labeling slip; same class).
+\*\* SOL-003 incidentally fired on withdraw_treasury's `invoke(` (line 183) — right
+location, wrong reason. Not counted as a catch.
+
+**Score: 2 / 9 seeded bugs caught by the default ruleset.**
+
+## Controls — clean?
+
+| # | Handler | Expected | Result |
+|---|---|---|---|
+| C1 | initialize | no flags | ❌ FALSE POSITIVE — SOL-008 LOW at line 26 (authority is a `Signer`; flag is wrong) |
+| C2 | claim_tile | no flags | ❌ FALSE POSITIVE — SOL-003 HIGH at line 58 (CPI target is a typed `Program<'info, System>`) |
+| C3 | list_tile | no flags | ✅ clean |
+| C4 | harvest | no flags | ✅ clean |
+
+**Controls: 2 / 4 clean.**
+
+## Bonus signal (experimental)
+
+SOL-012 flagged 4 duplicate-mutable pairs in the UncheckedAccount-heavy structs
+(BuyTile, BuyTileSpl, WithdrawTreasury) — not in the answer key, but aliasing there
+is genuinely exploitable (e.g., pass tile == seller in buy_tile). Counts as valid
+signal, experimental-only.
+
+## What this teaches the roadmap (0.3.2)
+
+1. **SOL-001**: `withdraw_treasury` has NO `Signer` field in its struct AND moves
+   lamports out — that combination alone should be CRITICAL. Currently silent.
+2. **SOL-005**: `2u64.pow(level) * x * y` feeding a transfer amount is the canonical
+   overflow shape — needs "mul/pow chain flows into transfer/CPI amount" detection,
+   not just assignment-to-state.
+3. **SOL-008**: must recognize `try_borrow_data()` + `u64::from_le_bytes(data[..])`
+   on an `UncheckedAccount` as trusting unvalidated bytes (B3, B9 pattern). Currently
+   it only fires on `.key()` reads — hence the C1 false positive and the B3/B9 misses.
+4. **SOL-009**: `**acct.try_borrow_mut_lamports()? = 0` + data zeroing is the manual
+   close shape; current rule apparently needs `assign`/realloc calls — widen it.
+5. **SOL-004**: an `UncheckedAccount` named/used as treasury with no `seeds`
+   constraint in a value-moving handler should flag.
+6. **SOL-013**: didn't fire even experimentally on `buy_tile_spl` — investigate.
+
+## Honest verdict
+
+2/9 with 2 false positives is a bad score on purpose-built ground truth — and this is
+the most valuable data the project has produced. Every miss above is a concrete,
+implementable rule improvement. The fixture + answer key are reusable regression
+tests: each 0.3.2 rule fix must raise the score without breaking the controls.
+
+---
+
+## 0.3.2 results (after engine fixes)
+
+**Fixture revised to v2 first (disclosed):** `withdraw_treasury` rewritten to the
+genuinely exploitable `invoke_signed` shape (v1's plain `invoke` could not actually
+drain — the source account would need to sign); `close_tile` now leaves data intact
+(v1 zeroed all data, which is the *safe* pattern); `buy_tile_spl` gained the
+realistic typed-token + in-scope-mint shape. v1 archived in `fixture_v1/`.
+
+| # | Bug | 0.3.1 | 0.3.2 |
+|---|---|---|---|
+| B1 | init_if_needed reinit | ✅ SOL-010 | ✅ SOL-010 |
+| B2 | overflow fee curve | ❌ | ✅ SOL-005 (variable-exponent pow) |
+| B3 | raw-byte trust (buy_tile) | ❌ | ✅ SOL-008 (alias-tracked data read) |
+| B4 | arbitrary CPI | ✅ SOL-003 | ✅ SOL-003 (raw program account) |
+| B5 | unbound mint | ❌ | ✅ SOL-013 (experimental) |
+| B6 | close-then-revive | ❌ | ✅ SOL-009 (try_borrow_mut_lamports) |
+| B7 | missing signer (treasury drain) | ❌ | ✅ SOL-001 (PDA-signed drain) |
+| B8 | unvalidated treasury PDA | ❌ | ✅ SOL-004 (PDA substitution) |
+| B9 | missing owner check | ❌ | ✅ SOL-008 |
+
+**Default ruleset: 8/9. With `--experimental`: 9/9.**
+
+Controls: initialize, claim_tile, list_tile, harvest — **all 4 clean** (the 0.3.1
+false positives are gone).
+
+Additional signal (not counted): SOL-004 also flags the unverified treasury fields in
+`upgrade_tile` and `buy_tile` (genuine B8-class issues, marked in the fixture);
+SOL-012 (experimental) flags duplicate-mutable pairs in the unchecked structs.
+
+Regression checks: 51/51 unit tests pass; labeled benchmark remains 100% precision /
+100% recall; marginfi re-scan 24 findings (was 20) with the main program clean —
+new signal lands in mock/integration programs.

package/examples/solscape/fixture_v1/lib_v1.rs

@@ -0,0 +1,403 @@
+//! SolScape — persistent on-chain territory game.
+//!
+//! ⚠️  INTENTIONALLY VULNERABLE TEST FIXTURE ⚠️
+//! This build contains deliberately seeded vulnerabilities for benchmarking the
+//! SolAudit scanner (see ANSWER_KEY.md). DO NOT DEPLOY. The hardened build lives
+//! in `programs/solscape-fixed/` and is the only version that may ever be deployed.
+
+use anchor_lang::prelude::*;
+use anchor_lang::solana_program::program::invoke;
+use anchor_lang::solana_program::system_instruction;
+
+declare_id!("So1Scape11111111111111111111111111111111111");
+
+pub const GRID_SIZE: u8 = 100;
+pub const CLAIM_FEE_LAMPORTS: u64 = 10_000_000; // 0.01 SOL
+pub const UPGRADE_BASE_FEE: u64 = 5_000_000; // 0.005 SOL
+pub const ROYALTY_BPS: u64 = 500; // 5%
+
+#[program]
+pub mod solscape {
+    use super::*;
+
+    /// C1 — clean control: proper init, seeds, signer.
+    pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
+        let config = &mut ctx.accounts.config;
+        config.authority = ctx.accounts.authority.key();
+        config.claim_fee = CLAIM_FEE_LAMPORTS;
+        config.royalty_bps = ROYALTY_BPS;
+        Ok(())
+    }
+
+    /// B1 — SEEDED: init_if_needed lets anyone wipe an existing profile back to zero.
+    pub fn register_player(ctx: Context<RegisterPlayer>) -> Result<()> {
+        let profile = &mut ctx.accounts.profile;
+        profile.owner = ctx.accounts.player.key();
+        profile.xp = 0;
+        profile.tiles_claimed = 0;
+        Ok(())
+    }
+
+    /// C2 — clean control: PDA via seeds, Signer, explicit system-program CPI.
+    pub fn claim_tile(ctx: Context<ClaimTile>, x: u8, y: u8) -> Result<()> {
+        require!(x < GRID_SIZE && y < GRID_SIZE, GameError::OutOfBounds);
+
+        let tile = &mut ctx.accounts.tile;
+        tile.owner = ctx.accounts.player.key();
+        tile.x = x;
+        tile.y = y;
+        tile.level = 1;
+        tile.list_price = 0;
+
+        let fee = ctx.accounts.config.claim_fee;
+        let ix = system_instruction::transfer(
+            &ctx.accounts.player.key(),
+            &ctx.accounts.treasury.key(),
+            fee,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.player.to_account_info(),
+                ctx.accounts.treasury.to_account_info(),
+                ctx.accounts.system_program.to_account_info(),
+            ],
+        )?;
+
+        let profile = &mut ctx.accounts.profile;
+        profile.tiles_claimed = profile.tiles_claimed.checked_add(1).unwrap();
+        Ok(())
+    }
+
+    /// B2 — SEEDED: price curve overflows; at level ≥ ~42 the fee wraps to near zero.
+    pub fn upgrade_tile(ctx: Context<UpgradeTile>) -> Result<()> {
+        let tile = &mut ctx.accounts.tile;
+        let profile = &ctx.accounts.profile;
+
+        // fee = base * 2^level * tiles_owned  — unchecked mul chain
+        let fee = UPGRADE_BASE_FEE
+            * 2u64.pow(tile.level as u32)
+            * profile.tiles_claimed as u64;
+
+        let ix = system_instruction::transfer(
+            &ctx.accounts.player.key(),
+            &ctx.accounts.treasury.key(),
+            fee,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.player.to_account_info(),
+                ctx.accounts.treasury.to_account_info(),
+            ],
+        )?;
+
+        tile.level = tile.level + 1;
+        Ok(())
+    }
+
+    /// C3 — clean control: has_one, Signer, no CPI.
+    pub fn list_tile(ctx: Context<ListTile>, price: u64) -> Result<()> {
+        let tile = &mut ctx.accounts.tile;
+        tile.list_price = price;
+        Ok(())
+    }
+
+    /// B3 — SEEDED: tile is a raw AccountInfo; owner/price are trusted from
+    /// attacker-controllable bytes. Pass any crafted account as "tile".
+    pub fn buy_tile(ctx: Context<BuyTile>) -> Result<()> {
+        let tile_info = &ctx.accounts.tile;
+        let data = tile_info.try_borrow_data()?;
+        // layout: [disc(8) | owner(32) | x(1) | y(1) | level(1) | list_price(8)]
+        let list_price = u64::from_le_bytes(data[43..51].try_into().unwrap());
+        let seller_key = Pubkey::try_from(&data[8..40]).unwrap();
+        require!(list_price > 0, GameError::NotForSale);
+
+        let royalty = list_price * ROYALTY_BPS / 10_000;
+        let seller_proceeds = list_price - royalty;
+
+        // pay seller — seller account is passed separately and unchecked
+        **ctx.accounts.buyer.try_borrow_mut_lamports()? -= list_price;
+        **ctx.accounts.seller.try_borrow_mut_lamports()? += seller_proceeds;
+        **ctx.accounts.treasury.try_borrow_mut_lamports()? += royalty;
+
+        // hand the tile to the buyer (in-memory only; never written back safely)
+        drop(data);
+        let mut data = tile_info.try_borrow_mut_data()?;
+        data[8..40].copy_from_slice(&ctx.accounts.buyer.key().to_bytes());
+        let _ = seller_key;
+        Ok(())
+    }
+
+    /// B4 + B5 — SEEDED: token program is an unchecked AccountInfo (arbitrary CPI
+    /// target), and the payment token account's mint is never bound to the official
+    /// fee mint. Pay with any token — or any program.
+    pub fn buy_tile_spl(ctx: Context<BuyTileSpl>, amount: u64) -> Result<()> {
+        let ix = spl_token_transfer(
+            &ctx.accounts.buyer_token.key(),
+            &ctx.accounts.seller_token.key(),
+            &ctx.accounts.buyer.key(),
+            amount,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.buyer_token.to_account_info(),
+                ctx.accounts.seller_token.to_account_info(),
+                ctx.accounts.buyer.to_account_info(),
+                ctx.accounts.token_program.to_account_info(),
+            ],
+        )?;
+
+        let tile = &mut ctx.accounts.tile;
+        tile.owner = ctx.accounts.buyer.key();
+        tile.list_price = 0;
+        Ok(())
+    }
+
+    /// B6 — SEEDED: manual close — lamports drained but discriminator zeroed only,
+    /// account can be revived in the same transaction with stale data.
+    pub fn close_tile(ctx: Context<CloseTile>) -> Result<()> {
+        let tile_info = &ctx.accounts.tile;
+        let dest = &ctx.accounts.owner;
+
+        let lamports = tile_info.lamports();
+        **tile_info.try_borrow_mut_lamports()? = 0;
+        **dest.try_borrow_mut_lamports()? += lamports;
+
+        let mut data = tile_info.try_borrow_mut_data()?;
+        for b in data.iter_mut() {
+            *b = 0;
+        }
+        Ok(())
+    }
+
+    /// B7 + B8 — SEEDED: authority is not a Signer (anyone can pass its pubkey), and
+    /// the treasury account is never checked against the derived PDA.
+    pub fn withdraw_treasury(ctx: Context<WithdrawTreasury>, amount: u64) -> Result<()> {
+        let ix = system_instruction::transfer(
+            &ctx.accounts.treasury.key(),
+            &ctx.accounts.recipient.key(),
+            amount,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.treasury.to_account_info(),
+                ctx.accounts.recipient.to_account_info(),
+            ],
+        )?;
+        Ok(())
+    }
+
+    /// B9 — SEEDED: profile is a raw AccountInfo with no owner check; a fake profile
+    /// account owned by an attacker program passes straight through.
+    pub fn grant_achievement(ctx: Context<GrantAchievement>, xp: u64) -> Result<()> {
+        let profile_info = &ctx.accounts.profile;
+        let mut data = profile_info.try_borrow_mut_data()?;
+        // layout: [disc(8) | owner(32) | xp(8) | tiles_claimed(4)]
+        let current = u64::from_le_bytes(data[40..48].try_into().unwrap());
+        data[40..48].copy_from_slice(&(current + xp).to_le_bytes());
+        Ok(())
+    }
+
+    /// C4 — clean control: checked math, has_one constraints.
+    pub fn harvest(ctx: Context<Harvest>) -> Result<()> {
+        let tile = &ctx.accounts.tile;
+        let profile = &mut ctx.accounts.profile;
+        let reward = (tile.level as u64)
+            .checked_mul(1_000)
+            .ok_or(GameError::Overflow)?;
+        profile.xp = profile.xp.checked_add(reward).ok_or(GameError::Overflow)?;
+        Ok(())
+    }
+}
+
+fn spl_token_transfer(from: &Pubkey, to: &Pubkey, authority: &Pubkey, amount: u64) -> anchor_lang::solana_program::instruction::Instruction {
+    // hand-rolled SPL Token transfer instruction (layout-compatible)
+    let mut data = vec![3u8];
+    data.extend_from_slice(&amount.to_le_bytes());
+    anchor_lang::solana_program::instruction::Instruction {
+        program_id: *from, // NOTE: caller passes the real program at invoke time; fixture only
+        accounts: vec![
+            AccountMeta::new(*from, false),
+            AccountMeta::new(*to, false),
+            AccountMeta::new_readonly(*authority, true),
+        ],
+        data,
+    }
+}
+
+// ------------------------- Accounts -------------------------
+
+#[derive(Accounts)]
+pub struct Initialize<'info> {
+    #[account(init, payer = authority, space = 8 + 32 + 8 + 8, seeds = [b"config"], bump)]
+    pub config: Account<'info, Config>,
+    /// CHECK: treasury PDA, system-owned vault
+    #[account(mut, seeds = [b"treasury"], bump)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub authority: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct RegisterPlayer<'info> {
+    #[account(init_if_needed, payer = player, space = 8 + 32 + 8 + 4, seeds = [b"player", player.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+#[instruction(x: u8, y: u8)]
+pub struct ClaimTile<'info> {
+    #[account(seeds = [b"config"], bump)]
+    pub config: Account<'info, Config>,
+    #[account(init, payer = player, space = 8 + 32 + 1 + 1 + 1 + 8, seeds = [b"tile", &[x], &[y]], bump)]
+    pub tile: Account<'info, Tile>,
+    #[account(mut, seeds = [b"player", player.key().as_ref()], bump, has_one = owner @ GameError::BadProfile)]
+    pub profile: Account<'info, PlayerProfile>,
+    /// CHECK: treasury PDA
+    #[account(mut, seeds = [b"treasury"], bump)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    /// CHECK: constraint-checked against profile.owner
+    pub owner: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct UpgradeTile<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    #[account(seeds = [b"player", owner.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    /// CHECK: treasury PDA
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    /// CHECK: matches tile.owner via has_one
+    pub owner: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct ListTile<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    pub owner: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct BuyTile<'info> {
+    /// CHECK: SEEDED — raw account, no owner/discriminator validation (B3)
+    #[account(mut)]
+    pub tile: UncheckedAccount<'info>,
+    /// CHECK: seller paid from tile bytes, never cross-checked
+    #[account(mut)]
+    pub seller: UncheckedAccount<'info>,
+    /// CHECK: treasury
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub buyer: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct BuyTileSpl<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    /// CHECK: SEEDED — buyer's token account; mint never bound (B5)
+    #[account(mut)]
+    pub buyer_token: UncheckedAccount<'info>,
+    /// CHECK: seller's token account
+    #[account(mut)]
+    pub seller_token: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub buyer: Signer<'info>,
+    /// CHECK: matches tile.owner via has_one
+    pub owner: UncheckedAccount<'info>,
+    /// CHECK: SEEDED — token program passed unchecked (B4)
+    pub token_program: UncheckedAccount<'info>,
+}
+
+#[derive(Accounts)]
+pub struct CloseTile<'info> {
+    /// CHECK: SEEDED — manual close path (B6)
+    #[account(mut)]
+    pub tile: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub owner: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct WithdrawTreasury<'info> {
+    /// CHECK: SEEDED — no signer enforcement, no PDA verification (B7, B8)
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    /// CHECK: recipient
+    #[account(mut)]
+    pub recipient: UncheckedAccount<'info>,
+    /// CHECK: authority is never required to sign
+    pub authority: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct GrantAchievement<'info> {
+    /// CHECK: SEEDED — raw profile account, no owner check (B9)
+    #[account(mut)]
+    pub profile: UncheckedAccount<'info>,
+    pub oracle: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct Harvest<'info> {
+    #[account(has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    #[account(mut, seeds = [b"player", owner.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    pub owner: Signer<'info>,
+}
+
+// ------------------------- State -------------------------
+
+#[account]
+pub struct Config {
+    pub authority: Pubkey,
+    pub claim_fee: u64,
+    pub royalty_bps: u64,
+}
+
+#[account]
+pub struct Tile {
+    pub owner: Pubkey,
+    pub x: u8,
+    pub y: u8,
+    pub level: u8,
+    pub list_price: u64,
+}
+
+#[account]
+pub struct PlayerProfile {
+    pub owner: Pubkey,
+    pub xp: u64,
+    pub tiles_claimed: u32,
+}
+
+#[error_code]
+pub enum GameError {
+    #[msg("Coordinates out of bounds")]
+    OutOfBounds,
+    #[msg("Tile is not listed for sale")]
+    NotForSale,
+    #[msg("Arithmetic overflow")]
+    Overflow,
+    #[msg("Profile mismatch")]
+    BadProfile,
+}

package/examples/solscape/programs/solscape/src/lib.rs

@@ -0,0 +1,410 @@
+//! SolScape — persistent on-chain territory game.
+//!
+//! ⚠️  INTENTIONALLY VULNERABLE TEST FIXTURE (v2) ⚠️
+//! This build contains deliberately seeded vulnerabilities for benchmarking the
+//! SolAudit scanner (see ANSWER_KEY.md). DO NOT DEPLOY. The hardened build lives
+//! in `programs/solscape-fixed/` and is the only version that may ever be deployed.
+//!
+//! v2 realism fixes (disclosed in SCORECARD.md):
+//!  - withdraw_treasury now uses invoke_signed (the genuinely exploitable shape)
+//!  - close_tile leaves account data intact (genuine close-then-revive)
+//!  - buy_tile_spl takes typed token accounts + a mint, with the CPI program id
+//!    sourced from an unchecked account (textbook arbitrary-CPI shape)
+
+use anchor_lang::prelude::*;
+use anchor_lang::solana_program::instruction::{AccountMeta, Instruction};
+use anchor_lang::solana_program::program::{invoke, invoke_signed};
+use anchor_lang::solana_program::system_instruction;
+use anchor_spl::token::{Mint, TokenAccount};
+
+declare_id!("So1Scape11111111111111111111111111111111111");
+
+pub const GRID_SIZE: u8 = 100;
+pub const CLAIM_FEE_LAMPORTS: u64 = 10_000_000; // 0.01 SOL
+pub const UPGRADE_BASE_FEE: u64 = 5_000_000; // 0.005 SOL
+pub const ROYALTY_BPS: u64 = 500; // 5%
+
+#[program]
+pub mod solscape {
+    use super::*;
+
+    /// C1 — clean control: proper init, seeds, signer.
+    pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
+        let config = &mut ctx.accounts.config;
+        config.authority = ctx.accounts.authority.key();
+        config.claim_fee = CLAIM_FEE_LAMPORTS;
+        config.royalty_bps = ROYALTY_BPS;
+        Ok(())
+    }
+
+    /// B1 — SEEDED: init_if_needed lets anyone wipe an existing profile back to zero.
+    pub fn register_player(ctx: Context<RegisterPlayer>) -> Result<()> {
+        let profile = &mut ctx.accounts.profile;
+        profile.owner = ctx.accounts.player.key();
+        profile.xp = 0;
+        profile.tiles_claimed = 0;
+        Ok(())
+    }
+
+    /// C2 — clean control: PDA via seeds, Signer, explicit system-program CPI.
+    pub fn claim_tile(ctx: Context<ClaimTile>, x: u8, y: u8) -> Result<()> {
+        require!(x < GRID_SIZE && y < GRID_SIZE, GameError::OutOfBounds);
+
+        let tile = &mut ctx.accounts.tile;
+        tile.owner = ctx.accounts.player.key();
+        tile.x = x;
+        tile.y = y;
+        tile.level = 1;
+        tile.list_price = 0;
+
+        let fee = ctx.accounts.config.claim_fee;
+        let ix = system_instruction::transfer(
+            &ctx.accounts.player.key(),
+            &ctx.accounts.treasury.key(),
+            fee,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.player.to_account_info(),
+                ctx.accounts.treasury.to_account_info(),
+                ctx.accounts.system_program.to_account_info(),
+            ],
+        )?;
+
+        let profile = &mut ctx.accounts.profile;
+        profile.tiles_claimed = profile.tiles_claimed.checked_add(1).unwrap();
+        Ok(())
+    }
+
+    /// B2 — SEEDED: price curve overflows; at high level the fee wraps to ~zero.
+    pub fn upgrade_tile(ctx: Context<UpgradeTile>) -> Result<()> {
+        let tile = &mut ctx.accounts.tile;
+        let profile = &ctx.accounts.profile;
+
+        // fee = base * 2^level * tiles_owned  — unchecked pow/mul chain
+        let fee = UPGRADE_BASE_FEE
+            * 2u64.pow(tile.level as u32)
+            * profile.tiles_claimed as u64;
+
+        let ix = system_instruction::transfer(
+            &ctx.accounts.player.key(),
+            &ctx.accounts.treasury.key(),
+            fee,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.player.to_account_info(),
+                ctx.accounts.treasury.to_account_info(),
+            ],
+        )?;
+
+        tile.level = tile.level + 1;
+        Ok(())
+    }
+
+    /// C3 — clean control: has_one, Signer, no CPI.
+    pub fn list_tile(ctx: Context<ListTile>, price: u64) -> Result<()> {
+        let tile = &mut ctx.accounts.tile;
+        tile.list_price = price;
+        Ok(())
+    }
+
+    /// B3 — SEEDED: tile is a raw account; price/seller are trusted from
+    /// attacker-controllable bytes. Pass any crafted account as "tile".
+    pub fn buy_tile(ctx: Context<BuyTile>) -> Result<()> {
+        let tile_info = &ctx.accounts.tile;
+        let data = tile_info.try_borrow_data()?;
+        // layout: [disc(8) | owner(32) | x(1) | y(1) | level(1) | list_price(8)]
+        let list_price = u64::from_le_bytes(data[43..51].try_into().unwrap());
+        require!(list_price > 0, GameError::NotForSale);
+
+        let royalty = list_price * ROYALTY_BPS / 10_000;
+        let seller_proceeds = list_price - royalty;
+
+        **ctx.accounts.buyer.try_borrow_mut_lamports()? -= list_price;
+        **ctx.accounts.seller.try_borrow_mut_lamports()? += seller_proceeds;
+        **ctx.accounts.treasury.try_borrow_mut_lamports()? += royalty;
+
+        drop(data);
+        let mut data = tile_info.try_borrow_mut_data()?;
+        data[8..40].copy_from_slice(&ctx.accounts.buyer.key().to_bytes());
+        Ok(())
+    }
+
+    /// B4 + B5 — SEEDED: the CPI program id comes from an UNCHECKED account
+    /// (arbitrary CPI), and buyer_token is never bound to the expected mint
+    /// (pay with worthless tokens — the Cashio class).
+    pub fn buy_tile_spl(ctx: Context<BuyTileSpl>, amount: u64) -> Result<()> {
+        let ix = spl_token_transfer(
+            &ctx.accounts.token_program.key(),
+            &ctx.accounts.buyer_token.key(),
+            &ctx.accounts.seller_token.key(),
+            &ctx.accounts.buyer.key(),
+            amount,
+        );
+        invoke(
+            &ix,
+            &[
+                ctx.accounts.buyer_token.to_account_info(),
+                ctx.accounts.seller_token.to_account_info(),
+                ctx.accounts.buyer.to_account_info(),
+                ctx.accounts.token_program.to_account_info(),
+            ],
+        )?;
+
+        let tile = &mut ctx.accounts.tile;
+        tile.owner = ctx.accounts.buyer.key();
+        tile.list_price = 0;
+        Ok(())
+    }
+
+    /// B6 — SEEDED: lamports drained but data/discriminator left intact and owner
+    /// not reassigned — the account can be re-funded and revived with stale state.
+    pub fn close_tile(ctx: Context<CloseTile>) -> Result<()> {
+        let tile_info = &ctx.accounts.tile;
+        let dest = &ctx.accounts.owner;
+
+        let lamports = tile_info.lamports();
+        **tile_info.try_borrow_mut_lamports()? = 0;
+        **dest.try_borrow_mut_lamports()? += lamports;
+        Ok(())
+    }
+
+    /// B7 + B8 — SEEDED: the program PDA-signs the transfer (so the runtime needs
+    /// no caller signature), `authority` is never required to sign, `recipient` is
+    /// caller-chosen, and `treasury` is never verified against the derived PDA.
+    /// Anyone can call this and drain the vault to themselves.
+    pub fn withdraw_treasury(ctx: Context<WithdrawTreasury>, amount: u64, bump: u8) -> Result<()> {
+        let ix = system_instruction::transfer(
+            &ctx.accounts.treasury.key(),
+            &ctx.accounts.recipient.key(),
+            amount,
+        );
+        invoke_signed(
+            &ix,
+            &[
+                ctx.accounts.treasury.to_account_info(),
+                ctx.accounts.recipient.to_account_info(),
+            ],
+            &[&[b"treasury", &[bump]]],
+        )?;
+        Ok(())
+    }
+
+    /// B9 — SEEDED: profile is a raw account with no owner check; a fake profile
+    /// account owned by an attacker program passes straight through.
+    pub fn grant_achievement(ctx: Context<GrantAchievement>, xp: u64) -> Result<()> {
+        let profile_info = &ctx.accounts.profile;
+        let mut data = profile_info.try_borrow_mut_data()?;
+        // layout: [disc(8) | owner(32) | xp(8) | tiles_claimed(4)]
+        let current = u64::from_le_bytes(data[40..48].try_into().unwrap());
+        data[40..48].copy_from_slice(&(current + xp).to_le_bytes());
+        Ok(())
+    }
+
+    /// C4 — clean control: checked math, has_one constraints.
+    pub fn harvest(ctx: Context<Harvest>) -> Result<()> {
+        let tile = &ctx.accounts.tile;
+        let profile = &mut ctx.accounts.profile;
+        let reward = (tile.level as u64)
+            .checked_mul(1_000)
+            .ok_or(GameError::Overflow)?;
+        profile.xp = profile.xp.checked_add(reward).ok_or(GameError::Overflow)?;
+        Ok(())
+    }
+}
+
+fn spl_token_transfer(
+    program_id: &Pubkey,
+    from: &Pubkey,
+    to: &Pubkey,
+    authority: &Pubkey,
+    amount: u64,
+) -> Instruction {
+    let mut data = vec![3u8];
+    data.extend_from_slice(&amount.to_le_bytes());
+    Instruction {
+        program_id: *program_id,
+        accounts: vec![
+            AccountMeta::new(*from, false),
+            AccountMeta::new(*to, false),
+            AccountMeta::new_readonly(*authority, true),
+        ],
+        data,
+    }
+}
+
+// ------------------------- Accounts -------------------------
+
+#[derive(Accounts)]
+pub struct Initialize<'info> {
+    #[account(init, payer = authority, space = 8 + 32 + 8 + 8, seeds = [b"config"], bump)]
+    pub config: Account<'info, Config>,
+    /// CHECK: treasury PDA, system-owned vault
+    #[account(mut, seeds = [b"treasury"], bump)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub authority: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct RegisterPlayer<'info> {
+    #[account(init_if_needed, payer = player, space = 8 + 32 + 8 + 4, seeds = [b"player", player.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+#[instruction(x: u8, y: u8)]
+pub struct ClaimTile<'info> {
+    #[account(seeds = [b"config"], bump)]
+    pub config: Account<'info, Config>,
+    #[account(init, payer = player, space = 8 + 32 + 1 + 1 + 1 + 8, seeds = [b"tile", &[x], &[y]], bump)]
+    pub tile: Account<'info, Tile>,
+    #[account(mut, seeds = [b"player", player.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    /// CHECK: treasury PDA
+    #[account(mut, seeds = [b"treasury"], bump)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct UpgradeTile<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    #[account(seeds = [b"player", owner.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    /// CHECK: treasury PDA — SEEDED B8-adjacent: no seeds binding here either
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub player: Signer<'info>,
+    /// CHECK: matches tile.owner via has_one
+    pub owner: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct ListTile<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    pub owner: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct BuyTile<'info> {
+    /// CHECK: SEEDED B3 — raw account, no owner/discriminator validation
+    #[account(mut)]
+    pub tile: UncheckedAccount<'info>,
+    /// CHECK: SEEDED B3 — seller paid without cross-checking against tile state
+    #[account(mut)]
+    pub seller: UncheckedAccount<'info>,
+    /// CHECK: SEEDED — treasury never PDA-verified in this struct
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub buyer: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct BuyTileSpl<'info> {
+    #[account(mut, has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    /// The official fee-token mint.
+    pub mint: Account<'info, Mint>,
+    /// SEEDED B5 — never bound to `mint` (token::mint = mint missing)
+    #[account(mut)]
+    pub buyer_token: Account<'info, TokenAccount>,
+    #[account(mut)]
+    pub seller_token: Account<'info, TokenAccount>,
+    #[account(mut)]
+    pub buyer: Signer<'info>,
+    /// CHECK: matches tile.owner via has_one
+    pub owner: UncheckedAccount<'info>,
+    /// CHECK: SEEDED B4 — CPI program id sourced from this unchecked account
+    pub token_program: UncheckedAccount<'info>,
+}
+
+#[derive(Accounts)]
+pub struct CloseTile<'info> {
+    /// CHECK: SEEDED B6 — manual close path
+    #[account(mut)]
+    pub tile: UncheckedAccount<'info>,
+    #[account(mut)]
+    pub owner: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct WithdrawTreasury<'info> {
+    /// CHECK: SEEDED B8 — never verified against the derived treasury PDA
+    #[account(mut)]
+    pub treasury: UncheckedAccount<'info>,
+    /// CHECK: SEEDED B7 — caller-chosen destination
+    #[account(mut)]
+    pub recipient: UncheckedAccount<'info>,
+    /// CHECK: SEEDED B7 — authority is never required to sign
+    pub authority: UncheckedAccount<'info>,
+    pub system_program: Program<'info, System>,
+}
+
+#[derive(Accounts)]
+pub struct GrantAchievement<'info> {
+    /// CHECK: SEEDED B9 — raw profile account, no owner check
+    #[account(mut)]
+    pub profile: UncheckedAccount<'info>,
+    pub oracle: Signer<'info>,
+}
+
+#[derive(Accounts)]
+pub struct Harvest<'info> {
+    #[account(has_one = owner)]
+    pub tile: Account<'info, Tile>,
+    #[account(mut, seeds = [b"player", owner.key().as_ref()], bump)]
+    pub profile: Account<'info, PlayerProfile>,
+    pub owner: Signer<'info>,
+}
+
+// ------------------------- State -------------------------
+
+#[account]
+pub struct Config {
+    pub authority: Pubkey,
+    pub claim_fee: u64,
+    pub royalty_bps: u64,
+}
+
+#[account]
+pub struct Tile {
+    pub owner: Pubkey,
+    pub x: u8,
+    pub y: u8,
+    pub level: u8,
+    pub list_price: u64,
+}
+
+#[account]
+pub struct PlayerProfile {
+    pub owner: Pubkey,
+    pub xp: u64,
+    pub tiles_claimed: u32,
+}
+
+#[error_code]
+pub enum GameError {
+    #[msg("Coordinates out of bounds")]
+    OutOfBounds,
+    #[msg("Tile is not listed for sale")]
+    NotForSale,
+    #[msg("Arithmetic overflow")]
+    Overflow,
+    #[msg("Profile mismatch")]
+    BadProfile,
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "solaudit",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Open-source static analysis CLI for Anchor/Solana programs",
   "type": "module",
   "bin": {