CPI Reentrancy Is Back: A Solana Developer's Defense Playbook for Token-2022 Transfer Hooks

Token-2022 transfer hooks reintroduce reentrancy vulnerabilities to Solana by allowing CPI callbacks into the calling program before state updates complete. The article outlines defensive strategies including Checks-Effects-Interactions (CEI) ordering and reentrancy guard (mutex) patterns, noting that Solana's atomic transaction model automatically reverts state on CPI failure.