Vulnerability GHSA-429q-fhh4-r6hj

High Risk

5 months ago

Anchor: `InterfaceAccount` allows account substitution between unexpected types

1.0.0-rc.1 and 1.0.0

Summary

Anchor: `InterfaceAccount` allows account substitution between unexpected types

Any uses of InterfaceAccount allows another unexpected account type to be passed, after https://github.com/solana-foundation/anchor/pull/3837 disabled discriminator checking for this type.

The bug was originally reported and fixed in https://github.com/solana-foundation/anchor/pull/4139, see that PR for more details.

https://github.com/solana-foundation/anchor/pull/4139 patched the issue and was released in 1.0.0-rc.2. Users should upgrade to the latest released version of Anchor 1.0.