withdraw_vulnerable.rs

use anchor_lang::prelude::*;
use crate::state::TokenAccount;

/// ⚠️ VULNERABLE: Withdraw with Unchecked Arithmetic
///
/// This instruction uses the standard subtraction operator (-) which does NOT
/// check for underflow in release builds with default Rust settings.
///
/// THE PROBLEM:
/// - When you subtract a larger number from a smaller number in unsigned integers,
///   it wraps around to a huge positive number instead of going negative
/// - Example: 0 - 1 = 18,446,744,073,709,551,615 (u64::MAX)
/// - This is called "integer underflow"
///
/// THE EXPLOIT:
/// An attacker with 0 balance can withdraw 1 token, and their balance becomes
/// u64::MAX (18.4 quintillion tokens!) - instant infinite money!
///
/// REAL-WORLD IMPACT:
/// This exact vulnerability has drained millions of dollars from DeFi protocols.
/// Examples include various token contracts and vaults that didn't use checked math.
///
#[derive(Accounts)]
pub struct WithdrawVulnerable<'info> {
    #[account(
        mut,
        seeds = [b"token", token_account.owner.as_ref()],
        bump = token_account.bump
    )]
    pub token_account: Account<'info, TokenAccount>,

    /// The account owner
    #[account(
        constraint = owner.key() == token_account.owner @ crate::error::ErrorCode::Unauthorized
    )]
    pub owner: Signer<'info>,
}

pub fn handler(ctx: Context<WithdrawVulnerable>, amount: u64) -> Result<()> {
    let token_account = &mut ctx.accounts.token_account;

    // ⚠️ VULNERABILITY: Using unchecked subtraction!
    //
    // In release builds, if balance < amount, this will UNDERFLOW instead of panicking.
    //
    // Example attack:
    // - User has balance = 0
    // - User calls withdraw(1)
    // - 0 - 1 = 18,446,744,073,709,551,615 (wraps around to u64::MAX)
    // - User now has virtually infinite tokens!
    //
    // NOTE: In debug builds, this WOULD panic, but release builds
    // (which are used in production) silently wrap around!
    token_account.balance = token_account.balance - amount;

    msg!(
        "⚠️ VULNERABLE: Withdrew {} tokens using unchecked math. New balance: {}",
        amount,
        token_account.balance
    );

    // If you see a balance of 18,446,744,073,709,551,615 here,
    // you've just witnessed the underflow exploit!

    Ok(())
}