solana-program-library icon indicating copy to clipboard operation
solana-program-library copied to clipboard

[token-2022] Confusing account owner check (ZELLIC 4.4)

Open samkim-crypto opened this issue 2 years ago • 0 comments

Account ownership checks are performed using a couple of different patterns through out the codebase. The main two checks are via validate_owner(...) and check_program_account(...), which work well. One area of confusion, though, is that calling get_required_account_extensions_from_unpacked_mint(...) performs an account ownership check. It is suggested that this check be migrated into StateWithExtensions::unpack and StateWithExtensionsMut::unpack. The SWE and SWEM unpack methods are only used with accounts that the program should own and would increase the resiliency of the codebase by mitigating a potential future situation where an account or mint is unpacked and data are used for some decision but program ownership failed to be checked.

samkim-crypto avatar Nov 18 '22 06:11 samkim-crypto