Account Discriminator Check
Security · Abyss
The security practice of validating an account's discriminator bytes before deserialization to prevent type cosplay attacks. Every Anchor account is prepended with an 8-byte discriminator (first 8 bytes of SHA-256 of 'account:<TypeName>'). Native programs must implement equivalent logic by writing a magic number or type tag at account creation and asserting it matches on every read. Skipping this check allows an attacker to pass an account of a different type whose raw bytes happen to deserialize into a struct with elevated privileges or manipulated values.