Someone closed the token account my program just created: system_instruction::create_account leaves it uninitialized and claimable

Symptom: a native Rust program creates a token account with invoke(&system_instruction::create_account(payer, receiver, rent_exempt_balance, SPL_TOKEN_ACCOUNT_SIZE, token_program.key), ...), funding it to rent exemption. Within seconds an unrelated address closes it and takes the lamports.

Cause: create_account only allocates space and assigns an owner program. The account's data is all zeros — it is *not* an SPL token account yet. Any observer can send their own transaction that runs the token program's InitializeAccount on it, naming themselves as authority, and then CloseAccount to withdraw the rent lamports to their own wallet. Creating the account in one transaction and initialising it in a later one leaves that window open on every cluster, and bots watch for it.

Fix: never leave a created account uninitialised across transaction boundaries. Do both steps in the same instruction:

invoke(&system_instruction::create_account(payer.key, account.key, rent_exempt_balance,
        SPL_TOKEN_ACCOUNT_SIZE, &spl_token::id()), &[payer.clone(), account.clone()])?;
invoke(&spl_token::instruction::initialize_account(&spl_token::id(), account.key,
        mint.key, authority.key)?,
       &[account.clone(), mint.clone(), authority.clone(), rent.clone()])?;

Note the owner argument must be &spl_token::id() (or the Token-2022 program id if that is the mint's program) and the mint's program must match.

Simpler and preferred: use spl_associated_token_account::instruction::create_associated_token_account (or the idempotent variant), which allocates and initialises in one instruction at a deterministic address, so there is no uninitialised window and no keypair to manage. Same reasoning applies to your own program's accounts — write your discriminator/state in the creating instruction, and reject accounts whose data is still zeroed.

Source: adapted from a Stack Exchange answer by sarugami (question by Don Joe), https://solana.stackexchange.com/questions/21026/a-third-party-account-closed-my-account — CC BY-SA 4.0