2

Let us suppose I have made a design, where I would be able to derive the PDA just by knowing the ID. So I have made a PDA that uses the inputted instruction ID parameter as a part of the seed.

#[derive(Accounts)]
#[instruction(params: Params)]
pub struct Context<'info> {
    #[account(
        init,
        seeds = [b"someSeed".as_ref(), params.id.as_bytes()]
        bump,
        payer = operator,
        space = N
    )]
    pub account: Account<'info, MyAccount>,

So I was wondering if this is something I would need to be wary of?

The plan is to have this instruction only be callable by operators and not by any users, which I have already made checks for.

Improve this question
1
  • 1
    imo it depends on the usecase generally it's used when a authority needs to create n no of PDA accounts but then. you do have to track the seeds as well inorder to derive the PDA again
    – Pratik.js
    Commented Jan 21, 2023 at 7:27

1 Answer 1

Reset to default
2

The main thing to keep in mind is potential DOS opportunities from someone crafting transactions with different IDs to create accounts, and potentially take control of them, if that's part of your program's logic. Otherwise, it should be fine!

Improve this answer
5
  • Basically, since it is so easy to derive my PDAs, adversaries can easily occupy those addresses by creating those accounts? Thus when I try to create a new PDA, the account would already exist and my instruction/transaction would fail?
    – Burger Bob
    Commented Jan 22, 2023 at 23:43
  • Yeah exactly. So if it's OK for anyone to create accounts, then you're fine
    – Jon C
    Commented Jan 23, 2023 at 12:36
  • Mhhmm I see, it is about time that I think of a different design. Thanks!
    – Burger Bob
    Commented Jan 23, 2023 at 22:46
  • Hi Jon, weird request but do you have any social media that I can follow?:)
    – Burger Bob
    Commented Jan 25, 2023 at 11:37
  • 1
    I tend to stay away from social media, sorry!
    – Jon C
    Commented Jan 25, 2023 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.