Suppose I use the function close, which closes an arbitrary account,

  pub fn close(ctx: Context<Close>) -> ProgramResult {
        let dest_starting_lamports = ctx.accounts.destination.lamports();

        let account = ctx.accounts.account.to_account_info();
        **ctx.accounts.destination.lamports.borrow_mut() = dest_starting_lamports
        **account.lamports.borrow_mut() = 0;

        let mut data = account.try_borrow_mut_data()?;
        for byte in data.deref_mut().iter_mut() {
            *byte = 0;

        let dst: &mut [u8] = &mut data;
        let mut cursor = Cursor::new(dst);


Where Close is a struct of addresses containing the address to close and the rent destination. What prevents me from just inputing any account, wouldn't the program be able to close it?

My guess is that any account that is passed on to the function must be owned by this program in order for it to close it is that so? However I fail to see how the code thats this into account

Finally, if this is the case how can a user give a program the right to burn this account the user owns?

1 Answer 1


A program can only close account which it has initialized. It could be PDAs, token accounts etc. You can't just pass any arbitrary account and close it.

If you wish to close a state/PDA account owned by the program, then you have to create a seperate instruction solely for closing it. You can see some ways to close accounts here, obviously follow the safest one: https://github.com/coral-xyz/sealevel-attacks/tree/master/programs/9-closing-accounts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.