Cross-Program State Remediation

Overview

Related Detector: Cross-Program State

Stale state after CPI causes race conditions. The fix is to reload all accounts that could have been modified by a CPI call before using their data.

Recommended Fix

invoke(&external_ix, accounts)?;
ctx.accounts.vault.reload()?;  // Refresh
let current_balance = ctx.accounts.vault.amount;

Common Mistakes

Mistake: Reading State Only Before CPI

let state = read_state(account)?;
invoke(&ix, accounts)?;
// WRONG: state variable is stale
use_state(state)?;

Always call reload() after CPI, then re-read.

References

• Solana — Cross-Program Invocations
• CWE-367: Time-of-check Time-of-use