claim_vulnerable.rs

use anchor_lang::prelude::*;
use crate::state::{RewardConfig, UserReward};

/// Claim rewards - creates user's reward account
///
/// ⚠️ VULNERABLE: Uses `init` constraint for user_reward account.
/// If the account already exists, this instruction will FAIL.
///
/// Attack scenario:
/// 1. User calls claim_vulnerable()
/// 2. Attacker sees pending transaction in mempool
/// 3. Attacker front-runs by creating user's reward account first
/// 4. User's transaction fails because account already exists
/// 5. User is blocked from claiming rewards!
#[derive(Accounts)]
pub struct ClaimVulnerable<'info> {
    #[account(
        seeds = [b"config"],
        bump = config.bump
    )]
    pub config: Account<'info, RewardConfig>,

    /// ⚠️ VULNERABLE: Using `init` means this FAILS if account exists!
    /// An attacker can create this account before the user, blocking them.
    #[account(
        init,
        payer = user,
        space = UserReward::LEN,
        seeds = [b"user_reward", config.key().as_ref(), user.key().as_ref()],
        bump
    )]
    pub user_reward: Account<'info, UserReward>,

    #[account(mut)]
    pub user: Signer<'info>,

    pub system_program: Program<'info, System>,
}

pub fn handler(ctx: Context<ClaimVulnerable>) -> Result<()> {
    let user_reward = &mut ctx.accounts.user_reward;

    user_reward.user = ctx.accounts.user.key();
    user_reward.config = ctx.accounts.config.key();
    user_reward.claimed = true;
    user_reward.bump = ctx.bumps.user_reward;

    msg!(
        "VULNERABLE: Claimed {} tokens via newly created account",
        ctx.accounts.config.reward_amount
    );

    Ok(())
}