Bug classes
- Missing signer check: an authority account that never has to sign
- Missing owner check: account data trusted without checking which program owns it
- Type confusion: one account type passed where another is expected
- PDA issues: unchecked seeds or bump, seed collisions
- Arbitrary CPI: calling a program ID supplied by the user
- Arithmetic: overflow, underflow, rounding in the attacker's favor
- Closing accounts: lamports drained but data or ownership left reusable
- Duplicate accounts: the same account passed twice as two different roles
To learn
- Reading past audit reports
- Writing proof-of-concept exploits for findings