Lamport Press

The whole volume, with the real source and the real tests on the page: https://lamport.press/books/basics?utm_source=x-lp

A Solana program has no memory of its own. Anything it has to remember lives in an account. Counter is the smallest version of that idea: one account, holding one number. No signer on the handler, so anyone holding the address can move it. https://t.co/wHKygHO026

https://lamport.press/

Skipping a check means a malicious caller can hand your program the wrong account and your logic will run against it anyway. Account validation is the line between secure and not.

A Solana instruction can name any accounts the caller wants. Nothing forces the right ones to reach your program. That's why Anchor's #[derive(Accounts)] struct exists: each field's type and constraints become validation rules that run before your handler does.