What is an "account revival attack"? Regarding the "#[account(close = <target_account>)]" constraint

Question

Trying to understand how the #[account(close = <target_account>)] constraint works and it says:

Marks the account as closed at the end of the instruction’s execution (sets its discriminator to the CLOSED_ACCOUNT_DISCRIMINATOR) and sends its lamports to the specified account. Setting the discriminator to a special variant makes account revival attacks (where a subsequent instruction adds the rent exemption lamports again) impossible. Requires mut to exist on the account.

Also looked through the examples here: https://github.com/coral-xyz/sealevel-attacks/tree/master/programs/9-closing-accounts

Could someone provide an example of how an account revival attack can be used as an exploit and explain why it is insecure to close an account without setting the discriminator to a special variant?

Answer 1

In your Solana program the #[account] attribute for a data type assigns a unique 8-byte discriminator for accounts of that type. i.e:

#[account]
pub struct MyType {}

When an account of that type is initialized, that 8-byte discriminator is assigned to it. In subsequent validators, the Account<'info, MyType> checks that the account being passed in was indeed created by your program. It does this by comparing the discriminators.

Now how does this affect closing accounts?

Well when an account is closed, setting the account's discriminator to the CLOSED_ACCOUNT_DISCRIMINATOR ensures that if/when that account is reinitialized by some other user, it doesn't pass the discriminator check and thus is not considered valid by our program(since its discriminator was reset).

Imagine a scenario where users pay 5 sol to create an account that grants them access to an nft mint. Let's say their accounts are closed once their mint is completed to prevent duplicit minting.

If such an account is closed without its discriminator being reset, attackers could simply revive the account and have it legally pass the discriminator checks in your mint instruction, letting them mint without having to pay the 5 sol to initialize the account(and set the valid discriminator) in the first place.

That is an account-revival attack.

Answer 2

The idea is just that you can send solana to the closed accounts and revive them. Program accounts that have had all their lamports removed don't get their ownership transferred to the system program until the end of the block. So, if your program assumes that an account has been closed but someone has managed to reactivate it, then some spooky stuff could happen to your code and potentially lead to an exploit. Anchor has the closed account discriminator so that even if someone put solana into the account, they won't be able to load the account in a function.