review-and-iterate

Run a structured review that checks P0 items like signer verification, account ownership, PDA validation, checked arithmetic, and reinitialization protection. Each finding includes a severity rating and a specific code fix rather than a generic warning.

The critical P0 checks are missing signer checks, unchecked math overflow, PDA confusion, reinitialization attacks, and type cosplay. Any critical security finding caps the overall project grade at C regardless of other scores.

Scores use a weighted average across six dimensions: security (3x), correctness (2x), error handling (2x), testing (1.5x), code organization (1x), and documentation (0.5x). The result maps to letter grades A through F.

Yes, the review never blocks on missing context. If a build-context.md file exists it is used for stack and architecture context, but the review proceeds immediately on whatever code exists in the current directory.

Consider formal verification tools like QEDGen when the program protects high-value assets, has complex state machines, or depends on critical invariants like authorization, conservation, or arithmetic bounds that benefit from machine-checked proofs.

Minimize account reads, remove debug msg! logging, use fixed-size data structures, and batch CPIs. For compute-intensive programs near CU limits, Pinocchio can reduce usage by 88-95% compared to Anchor.