Does PDA owned by System Program safe?

Question

I want to generate PDA with PublicKey.findProgramAddress and get them to users.

Is there any way to withdraw funds from this PDA, outside of the Solana program, whose ID was used to create this PDA? Taking into account the fact that the attacker knows all the information about how this PDA was generated, such as seeds, program ID, bump, and PDA itself.

Answer 1

If a PDA is owned by the system program, then the only way to move lamports from that account is using invoke_signed to generate a "signature" from that PDA. "Signature" is in quotes because there is no actual signature, but rather a proof to the runtime that the call came from the correct program.

Only the program whose id is used to generate the PDA may "sign" for that account, so it's totally safe. Even if an attacker knows everything about the PDA, your program must still authorize the moving of funds, so your program must be careful about providing "signatures" for the PDA.

For example, when providing a "signature" for the PDA to another program, your program must be sure that it's calling into the correct program (the system program, the spl-token program, etc). If your program calls into a malicious program, an attacker may be able to do something nasty.