Rent Exemption Violation Remediation

Overview

Related Detector: Rent Exemption Violation

Accounts below rent-exempt minimum are subject to deletion. The fix is to always use Rent::get()?.minimum_balance(data_len) when creating accounts and to verify remaining balance meets the threshold after any lamport withdrawal.

Recommended Fix

Before (Vulnerable)

// Vulnerable: hardcoded lamport value
invoke(&system_instruction::create_account(payer, vault, 1_000_000, space, &program_id), accounts)

After (Fixed)

let rent = Rent::get()?;
let lamports = rent.minimum_balance(space as usize);
invoke(&system_instruction::create_account(payer, vault, lamports, space, &program_id), accounts)

Alternative Mitigations

Anchor init Macro

Anchor’s init constraint automatically calculates rent-exempt balance:

#[derive(Accounts)]
pub struct Initialize<'info> {
    #[account(init, payer = user, space = 8 + Vault::INIT_SPACE)]
    pub vault: Account<'info, Vault>,
    #[account(mut)]
    pub user: Signer<'info>,
    pub system_program: Program<'info, System>,
}

Common Mistakes

Mistake: Not Checking After Withdrawal

// WRONG: withdrawal may drop below rent-exempt minimum
**vault.lamports.borrow_mut() -= withdraw_amount;

Always verify: vault.lamports() - amount >= rent.minimum_balance(vault.data_len()).

References

• Solana — Rent
• CWE-404: Improper Resource Shutdown or Release