solana-program-library icon indicating copy to clipboard operation
solana-program-library copied to clipboard

token-2022: Consider removing `check_program_account` on program id in instruction processors

Open joncinque opened this issue 1 year ago • 0 comments

Problem

Token-2022 has a generic function for checking that a pubkey matches spl_token_2022::id(). It's typically meant for checking the owner of accounts, but it's also used to make sure that the executing program id is spl_token_2022::id(), ie:

https://github.com/solana-labs/solana-program-library/blob/b02468f35986ad749e1863f2f57e80dc7265d13e/token/program-2022/src/extension/confidential_transfer/processor.rs#L1038

This means that if someone just builds and deploys the program without changing the declare_id!, it won't work. No other program works this way. It should be possible to just build and deploy a program.

Solution

Remove check_program_account in favor of checking against the actual executing program id.

joncinque avatar Nov 28 '23 11:11 joncinque