I've recently learnt SPL token, and surprisingly found that when transferring tokens, the source account and destination account are private key accounts (instead of PDAs) that are owned by the token program. Why doesn't the token program use PDA?

As a new Solana user from Ethereum ecosystem, I always think PDAs as smart contract's storage in Ethereum. They are similar in that PDAs are used to store program data, just as Ethereum smart contract's storage. In Ethereum, every ERC20 token stores each account's balance in its storage.

I don't understand why SPL use private key accounts. When I want to transfer some tokens to others, I only need to provide the source account's authority account's signature, so source account's private key is useless. In this case, isn't PDA more appropriate?

Could anyone explain? Any help is appreciated. Thanks in advance :)

2 Answers 2


After some research, my conclusion is: a token account can be a private key account, and it can also be a PDA.

I've generated a keypair, and I successfully made the public key a token account (Here is the transaction on testnet). It seems that it doesn't matter whether the account is private key account or PDA.

Some thoughts: The term "Associated Token Account" (aka. ATA) seems to specifically indicate a token account that is derived from the program "Associated Token Program" at address ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL. In another word, a token account is not necessarily be an ATA (which is derived from "Associated Token Program").


The associated token accounts that you use to send and receive SPL tokens are PDAs.

  • Thanks for answering! But from my knowledge, the accounts are not PDAs. Solana's doc here says SPL token's InitializeAccount instruction should be in the same transaction with System Program's CreateAccount instruction. Also, in the token program processor's source code here, it hasn't derived any account...
    – Yan
    Commented Feb 12 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.