1

I want to generate PDA with PublicKey.findProgramAddress and get them to users.

Is there any way to withdraw funds from this PDA, outside of the Solana program, whose ID was used to create this PDA? Taking into account the fact that the attacker knows all the information about how this PDA was generated, such as seeds, program ID, bump, and PDA itself.

1 Answer 1

1

If a PDA is owned by the system program, then the only way to move lamports from that account is using invoke_signed to generate a "signature" from that PDA. "Signature" is in quotes because there is no actual signature, but rather a proof to the runtime that the call came from the correct program.

Only the program whose id is used to generate the PDA may "sign" for that account, so it's totally safe. Even if an attacker knows everything about the PDA, your program must still authorize the moving of funds, so your program must be careful about providing "signatures" for the PDA.

For example, when providing a "signature" for the PDA to another program, your program must be sure that it's calling into the correct program (the system program, the spl-token program, etc). If your program calls into a malicious program, an attacker may be able to do something nasty.

2
  • Thank you very much for your answer! Is it possible, if you know, to share the piece of Solana code where this check happens - "Only the program whose id is used to generate the PDA may "sign" for that account, so it's totally safe."? Feb 27 at 7:44
  • Certainly! Here's the code in the syscall to perform a cross-program invocation. You'll see that it takes all the seeds from invoke_signed and creates program addresses with those, and promotes those addresses to signers in the instruction: github.com/solana-labs/solana/blob/…
    – Jon C
    Feb 27 at 11:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.