Bump Seed Canonicalization
Security · Abyss
A vulnerability where a program derives a PDA using a caller-supplied bump seed instead of the canonical (highest valid) bump returned by find_program_address, allowing an attacker to create multiple valid PDAs for the same logical account and bypass uniqueness assumptions. The canonical bump is the first value (counting down from 255) that produces a point off the ed25519 curve. Defense: store the canonical bump at initialization and verify it on subsequent calls; Anchor enforces this via the bump constraint.