Is it safe to use UncheckedAccount if it is simply the destination address for a SOL transfer?

Question

The anchor documentation recommends not using the UncheckedAccount type unless you are sure that there are no security vulnerabilities.

Explicit wrapper for AccountInfo types to emphasize that no checks are performed

In the following scenario where I make a transfer from one account to another

#[derive(Accounts)]
pub struct Transfer<'info> {
    #[account(mut)]
    pub from: Signer<'info>,
    #[account(mut)]
    /// CHECK: Fine to be unsafe, we only need to send the funds to the winner
    pub to: UncheckedAccount<'info>
}

is it safe to mark the to account as UncheckedAccount? What are the security implications?

Answer 1

Anchor includes a SystemAccount type that you can use if the expected to account will always be a system program owned account (ex. a user's wallet address).

#[derive(Accounts)]
pub struct Transfer<'info> {
    pub from: Signer<'info>,
    #[account(mut)]
    pub to: SystemAccount<'info>
}

Using the UncheckedAccount type would allow the recipient of the transfer to be any account (such as program account, or an account owned by other program).

You would need to specify that the from account is mutable with #[account(mut)]. Maybe add a test to see if the balances after the transfer actually changes.