Skip to main content
added 211 characters in body
Source Link

TLDR : You should do both(to be on the safe side).

  1. this works as long as you always used the canonical bump , this is what anchor does too, if you dont specify a deserialized account type, and add a seed check on an UncheckedAccount, because only the intended program can create a pda via system account and sign for it , i guess the ownership check is not that important in the case of pda's, happy to be proven wrong here as if the program is not a owner it will never be able to sign for it or write data to it, and find program address will return the programs own pda as long -as the program id u pass is of the executing program.
  2. This i believe is useful for e.g with the token program you have a wallet associated pda account or a normal account, it is essential to check the owner is token program as only token program can write to an account it owns , otherwise any one can create a program write to it arbitarily/maliciously also the pubkey check would be too restricted i.e would act as a whitelist and would be something you verify on your end, for example the associated token account could be a pubkey check since its a pda where the wallet address is one of the seed, pubkey check makes more sense if you are 100% sure the pubkey is a pda.

TLDR : You should do both(to be on the safe side).

  1. this works as long as you always used the canonical bump , this is what anchor does too, if you dont specify a deserialized account type, and add a seed check on an UncheckedAccount, because only the intended program can create a pda via system account and sign for it , i guess the ownership check is not that important in the case of pda's, happy to be proven wrong here.
  2. This i believe is useful for e.g with the token program you have a wallet associated pda account or a normal account, it is essential to check the owner is token program as only token program can write to an account it owns , otherwise any one can create a program write to it arbitarily/maliciously also the pubkey check would be too restricted i.e would act as a whitelist and would be something you verify on your end, for example the associated token account could be a pubkey check since its a pda where the wallet address is one of the seed, pubkey check makes more sense if you are 100% sure the pubkey is a pda.

TLDR : You should do both(to be on the safe side).

  1. this works as long as you always used the canonical bump , this is what anchor does too, if you dont specify a deserialized account type, and add a seed check on an UncheckedAccount, because only the intended program can create a pda via system account and sign for it , i guess the ownership check is not that important in the case of pda's, happy to be proven wrong here as if the program is not a owner it will never be able to sign for it or write data to it, and find program address will return the programs own pda as long -as the program id u pass is of the executing program.
  2. This i believe is useful for e.g with the token program you have a wallet associated pda account or a normal account, it is essential to check the owner is token program as only token program can write to an account it owns , otherwise any one can create a program write to it arbitarily/maliciously also the pubkey check would be too restricted i.e would act as a whitelist and would be something you verify on your end, for example the associated token account could be a pubkey check since its a pda where the wallet address is one of the seed, pubkey check makes more sense if you are 100% sure the pubkey is a pda.
Source Link

TLDR : You should do both(to be on the safe side).

  1. this works as long as you always used the canonical bump , this is what anchor does too, if you dont specify a deserialized account type, and add a seed check on an UncheckedAccount, because only the intended program can create a pda via system account and sign for it , i guess the ownership check is not that important in the case of pda's, happy to be proven wrong here.
  2. This i believe is useful for e.g with the token program you have a wallet associated pda account or a normal account, it is essential to check the owner is token program as only token program can write to an account it owns , otherwise any one can create a program write to it arbitarily/maliciously also the pubkey check would be too restricted i.e would act as a whitelist and would be something you verify on your end, for example the associated token account could be a pubkey check since its a pda where the wallet address is one of the seed, pubkey check makes more sense if you are 100% sure the pubkey is a pda.