Can malicious user create fake or dust PDA accounts on my program?

Question

Let's say I have protest the init function, see bellow. Then can malicious user bypass my barrier to create dust or evil PDA account on my program?

    pub fn initialize(ctx: Context<Initialize>, input: String) -> Result<()> {
        msg!("Initialize data to: {}", input);
        ctx.accounts.new_account.data = input;
        Ok(())
    }

   ...

#[derive(Accounts)]
#[instruction(input: String)] 
pub struct Initialize<'info> {
    #[account(mut)]
    pub authority: Signer<'info>,
    #[account(
        init, 
        payer = authority, 
        space = 8 + 8 + 32,
        seed = [input.as_bytes()]
        has_one = authority,      
    )]
    pub new_account: Account<'info, DataAccount>,
    pub system_program: Program<'info, System>,
}

#[account]
pub struct DataAccount {
    data: u64, // 8 bytes
    authority: Pubkey, // 32 bytes
}

Suppose I will go to create a PDA account use "ABCD" as key, I don't expect others to create it before me.

I think it is safe, but not sure.

Update:

Let's consider more factor : if my program expose other method who will also create PDA account for user to store their own data, and this method have no access limitation, then I should be careful to avoid such case that the seeds collide with other PDAs (for example, the Admin purpose PDA) right?

Can your guys come up with other case that should take caution?

Answer 1

If i get it correctly your authority is the signer, if you make your fn only callable by your account then you are the only one who can create a PDA from it.

else perhaps anyone can create dust/fake PDA off your program but in this case you'll just have to filter the PDA by creator and only use the one you instantiated.