Authority in Solana

Question

I'm quite new in Solana, so please confirm or deny:

If i make a call to any program having following addresses in the list:

1. my account as signer
2. token address of any status (read/write)
3. my token account (write)
4. any other token account (write)
5. token program

Than any program, that will be called during this transaction, have the authority to transfer assets from my acc to this other acc?

In other words, calling any program with some list of accounds, gives this program ability to make all actions, that I myself could possibly do with the same list of accounts?

Answer 1

Yes, but key thing here is that you must sign the transaction. Your digital signature is the most important thing here, and if a transaction is signed by you, then anything can be done in that transaction on your behalf. Which is why in the program, your particular account must be passed as a signer, not as any regular account.

When you use a wallet, like Phantom, actions like sending SOL, staking, swapping etc. all are signed automatically by the wallet so that you don't have to "confirm" your signature each time. It is only when external program/website requires your authority or any action related to your funds/account on your behalf, then Phantom or any other wallet gives you a popup confirmation.

Refer to Solana Account Model

Answer 2

So yes, as already mentioned, the simple answer is that the highest permissions are given to all instructions in the transaction.

However, you can deescalate those permissions when do are doing a CPI.

Here is a long answer to you question: https://youtu.be/uuE1ftoJbZc