Anchor Expert Guide - January 2026

What is Anchor?

Anchor is a framework for Solana smart contract development that provides:

• Security by default - Automatic checks for common vulnerabilities
• Simplified account management - Declarative account validation
• IDL generation - Automatic TypeScript client generation
• Testing framework - Integrated testing with TypeScript
• CLI tooling - Build, deploy, test, upgrade programs

Current Version: 0.32.1 Solana Version: 1.18+ (compatible with 2.x)

When to Use This Skill

• Writing Rust smart contracts for Solana
• Implementing secure account validation
• Building cross-program invocations (CPI)
• Testing programs with Mollusk or LiteSVM
• Deploying and upgrading programs
• Generating TypeScript clients

Quick Reference

See

.claude/rules/programs.md

for comprehensive patterns and security checklist.

Core Patterns

Program Structure

use anchor_lang::prelude::*;

declare_id!("YourProgramId11111111111111111111111111111");

#[program]
pub mod my_program {
    use super::*;

    pub fn initialize(ctx: Context<Initialize>) -> Result<()> {
        // Implementation
        Ok(())
    }
}

#[derive(Accounts)]
pub struct Initialize<'info> {
    #[account(init, payer = user, space = 8 + MyAccount::INIT_SPACE)]
    pub my_account: Account<'info, MyAccount>,

    #[account(mut)]
    pub user: Signer<'info>,

    pub system_program: Program<'info, System>,
}

#[account]
#[derive(InitSpace)]
pub struct MyAccount {
    pub data: u64,
}

Critical Security Rules

1. ALWAYS verify account ownership: Use

   Account<'info, T>

   not

   AccountInfo

2. ALWAYS use checked arithmetic:

   .checked_add()

   ,

   .checked_mul()

   , etc.
3. ALWAYS validate signers: Use

   Signer<'info>

   for authorities
4. ALWAYS store PDA bumps: Store bump seeds in account data
5. NEVER use init_if_needed without validation: Reinitialization attacks

Account Constraints

// Initialize new account
#[account(init, payer = user, space = 8 + SIZE)]

// PDA with seeds
#[account(seeds = [b"my-seed", user.key().as_ref()], bump)]

// Verify field matches
#[account(has_one = authority)]

// Custom constraint
#[account(constraint = amount > 0 @ ErrorCode::InvalidAmount)]

// Close account
#[account(close = authority)]

Testing

Mollusk (Fast Unit Tests)

use mollusk::Mollusk;

#[test]
fn test_initialize() {
    let program_id = Pubkey::new_unique();
    let mut mollusk = Mollusk::new(&program_id, "target/deploy/my_program");

    // Test execution...
}

Anchor Tests (Integration)

anchor test                # Run all tests
anchor test --skip-local-validator  # Skip starting validator

Deployment

# Build
anchor build

# Deploy to devnet
anchor deploy

# Upgrade existing program
anchor upgrade target/deploy/program.so --program-id <ID>

# Verify
solana program show <PROGRAM_ID>

Additional Resources

• Full patterns:

  .claude/rules/programs.md

• Anchor Docs: https://anchor-lang.com/docs
• Security Audit: https://github.com/coral-xyz/sealevel-attacks