0

I'm working with a Solana program and I have the following code:

#[derive(Accounts)]
pub struct SomeStruct<'info> {
    #[account()]
    pub state: Account<'info, State>,
    ....
}

I'm initializing this state variable of SomeStruct in the initializer of the contract, which can't be reinitialized.

pub fn lock_tokens(ctx: Context<SomeStruct>, amount: u64) -> Result<()> {
   ...
}

lock_tokens now needs the SomeStruct to perform its internal logic. Is it possible for someone to initialize their own state account with dummy data and pass it into the contract in SomeStruct? If so, how can one do that?

1 Answer 1

1

If the state is similar, you can have a signer check using the addres anchor constraint to make sure that only a pre-configured address can call the IX to initialize the state

#[derive(Accounts)]
pub struct InitEscrow<'info> {
    #[account(
        mut 
        address = "public key of admin address"
     )]
    pub authority: Signer<'info>,

    /// CHECK: checked by us
    #[account(
        init,
        payer = authority,
        space = LEN,
        seeds = [b"SOME_SEED_PREFIX" authority.key().as_ref()],
        bump
    )]
    pub state: Account<'info, State>,

    pub system_program: Program<'info, System>,
}
9
  • Hey, the idea is that state variable is same for all accounts, but i want to understand if someone can maliciously use a custom state account and send to my function, would he be able to use his dummy values like that?
    – zOthix
    Commented May 29 at 12:39
  • updated my answer. You can use the address check for this and after the account is initialized you needn't worry about this. IF you add an edit ix, you can use the same address constraint
    – Jimii
    Commented May 29 at 13:01
  • Hey the question is, that i dont want to edit my code, can someone still maliciously use his own account instead of using the contract defined account which we initialized in initialize function ? given that the initialize function cant be called again
    – zOthix
    Commented May 29 at 13:05
  • with your code, as is without any constraints and if the account isn't initialized yes.
    – Jimii
    Commented May 29 at 13:16
  • 1
    If someone call lock_okens, it again would fail. Check out helius.dev/blog/a-hitchhikers-guide-to-solana-program-security and anchor-lang.com/docs/security-exploits though a bit dated but still relevant.
    – Jimii
    Commented May 29 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.