chore(docs): Updated docs and CHANGELOG.md

Author: swaroop-osec

CHANGELOG.md

@@ -16,6 +16,7 @@ The minor version will be incremented upon a breaking change and the patch versi
 - lang: Replace `solana-program` crate with smaller crates ([#3819](https://github.com/solana-foundation/anchor/pull/3819)).
 - cli: Replace `anchor verify` to use `solana-verify` under the hood, adding automatic installation via AVM, local path support, and future-proof argument passing ([#3768](https://github.com/solana-foundation/anchor/pull/3768)).
 - cli: Make `anchor deploy` to upload the IDL to the cluster by default unless `--no-idl` is passed ([#3863](https://github.com/solana-foundation/anchor/pull/3863)).
+- lang: Disallow duplicate mutable accounts by default. But allows duplicate mutable accounts in instruction contexts using `dup` constraint ([#3899](https://github.com/solana-foundation/anchor/pull/3899)).
 
 ### Fixes
 

docs/content/docs/references/account-constraints.mdx

@@ -38,6 +38,33 @@ Examples: [Github](https://github.com/solana-developers/anchor-examples/tree/mai
 #[account(mut @ <custom_error>)]
 ```
 
+### `#[account(dup)]`
+
+Description: By default, Anchor will prevents duplicate mutable accounts to avoid potential security issues and unintended behavior. 
+The `dup` constraint explicitly allows this for cases where it's intentional and safe.
+
+**Note**: This constraint only applies to mutable accounts (`mut`). Readonly accounts naturally allow duplicates without requiring the `dup` constraint.
+
+```rust title="attribute"
+#[account(mut, dup)]
+#[account(mut, dup @ <custom_error>)]
+```
+
+```rust title="snippet"
+#[derive(Accounts)]
+pub struct AllowsDuplicateMutable<'info> {
+    #[account(mut)]
+    pub account1: Account<'info, Counter>,
+    // This account can be the same as account1
+    #[account(mut, dup)]
+    pub account2: Account<'info, Counter>,
+}
+
+pub fn allows_duplicate_mutable(ctx: Context<AllowsDuplicateMutable>) -> Result<()> {
+    Ok(())
+}
+```
+
 ### `#[account(init)]`
 
 Description: Creates the account via a CPI to the system program and initializes

lang/derive/accounts/src/lib.rs

@@ -90,6 +90,22 @@ use syn::parse_macro_input;
 ///         </tr>
 ///         <tr>
 ///             <td>
+///                 <code>#[account(dup)]</code> <br><br>
+///             </td>
+///             <td>
+///                 Allows the same mutable account to be passed multiple times within the same instruction context.<br>
+///                 By default, Anchor will prevents duplicate mutable accounts to avoid potential security issues and unintended behavior.<br>
+///                 The <code>dup</code> constraint explicitly allows this for cases where it's intentional and safe.<br>
+///                 This constraint only applies to mutable accounts (<code>mut</code>). Readonly accounts naturally allow duplicates without requiring the <code>dup</code> constraint.<br>
+///                 Example:
+///                 <pre><code>
+/// #[account(mut)]
+/// pub account1: Account<'info, Counter>,
+///                 </code></pre>
+///             </td>
+///         </tr>
+///         <tr>
+///             <td>
 ///                 <code>#[account(init, payer = &lt;target_account&gt;, space = &lt;num_bytes&gt;)]</code>
 ///             </td>
 ///             <td>