Anchor: Do I need to validate PDAs when passing them into my program?

Question

Since only the program(owner) of a PDA can modify it's data.

Do I have to validate a PDA passed to the program via seed and canonical bump?

Example: If I initialize a Group PDA...

#[derive(Accounts)]
#[instruction(id: String)]
pub struct InitGroup<'info> {
  #[account(init, payer = group_leader, space = 8 + Group::INIT_SPACE,
   seeds = [b"example_seed", group_leader.key().as_ref(), id.as_bytes()], bump )]
  pub group: Account<'info, Group>,
  #[account(mut)]
  pub group_leader: Signer<'info>,
}
...
#[derive(Accounts)]
pub struct WithdrawFromGroup<'info> {
  #[account(mut)] // <-- no validation ok?
  pub group: Account<'info, Group>,
}

OR should I add PDA validation like:

  #[account(
    seeds = [b"example_seed", group_leader.key().as_ref(), id.as_bytes()], bump )]
  pub group: Account<'info, Group>,

Validation requires extra function arguments... in some cases, I do not need those function arguments except for PDA validation...

Reference:

https://solana.com/docs/core/pda

Confusion about PDAs

Answer 1

Not really,

But you should. You can do it as suggested using an anchor constraint in the #[derive(Accounts)] struct

    #[account(
        seeds = [b"some_seed"],
        bump,
        seeds::program = other_program.key()
    )]
    pub group: AccountInfo<'info>,
    pub other_program: Program<'info, OtherProgram>

Or using the create_program_address in your instruction body which saves compute if you stored the bump somewhere.

  let group = Pubkey::create_program_address(
            &[
                b"some_seed"
            ],
            &ctx.accounts.other_program.to_account_info(),
        )
        .unwrap();

Answer 2

yes you should otherwise people could just give any PDA address from your program (of the same kind)