# Account-check model — September 5, 2026

A local Rust model of four application checks. This is not a Solana runtime,
PDA validator or deployed program. Byte-sized keys stand in for decoded public
keys solely to make the validation combinations readable.

```sh
rustc account_checks.rs -o /tmp/defisec-account-checks
/tmp/defisec-account-checks > results.csv
```

Recorded environment: rustc 1.86.0. The 16 masks cover every true/false combination
of owner, authority identity, signer and vault identity checks. One valid
combination accepts a withdrawal of 3 from 10 and returns 7; 15 reject.
Three additional amount assertions cover 0, the whole balance and an excessive
withdrawal. All passed. The CSV records the first rejecting check, not a list
of every failing check in that row.

Real programs also need correct account deserialization, PDA seed derivation,
token-program/mint relationships, CPI target validation, account alias rules
and runtime tests. The result cannot establish that any real program is safe.