README.md

Logic Vulnerability: The Root Cause

In the Solana programming model, a "Logic Vulnerability" occurs when there is a disconnect between the developer's assumptions and the actual state validation performed by the runtime.

The "Trust but Verify" Paradox

Developers often mistakenly "trust" an account simply because it was passed into an instruction. The Solana runtime is account-agnostic; it does not know the intended structure of an account.

The vulnerability manifests when:

• Missing Ownership Check: The program processes data from an account without verifying the owner.
• Shadow Accounts: An attacker provides an account with the same structure but controlled by a different program.
• Lack of Validation Constraints: Failing to enforce signer or address checks allows account substitution.

Why this matters:

Logic vulnerabilities are the most dangerous because they often pass automated security scanners. They require a human-in-the-loop audit to ensure the business intent is strictly enforced.