CPI fails with Cross-program invocation with unauthorized signer or writable account

Question

i'm facing a weird issue. I'm trying to transfer token (2022) from a pda to a user token account. The code looks like this:

    let transfer_checked_discriminant: u8 = 0x0c;
  
  let amount: u64 = 1;
  let decimals: u8 = 0;
  
  let accounts = vec![
      AccountMeta::new(ctx.accounts.pda_token_account.key(), false), 
      AccountMeta::new_readonly(ctx.accounts.mint.key(), false),             
      AccountMeta::new(ctx.accounts.seller_token_account.key(), false),    
      AccountMeta::new(ctx.accounts.pda_token_authority.key(), true),                
      AccountMeta::new_readonly(ctx.accounts.hook_program.key(), false),    
  ];

  let mut data = vec![transfer_checked_discriminant];  
  data.extend_from_slice(&amount.to_le_bytes());       
  data.push(decimals);                               

  let instruction = Instruction {
      program_id: ctx.accounts.token_program.key(),
      accounts,
      data,
  };
  
  solana_program::program::invoke_signed(
      &instruction,
      &[
          ctx.accounts.pda_token_account.to_account_info(),
          ctx.accounts.mint.to_account_info(),
          ctx.accounts.seller_token_account.to_account_info(),
          ctx.accounts.pda_token_authority.to_account_info(),
          ctx.accounts.hook_program.to_account_info(), 
      ],
      signer_seeds,
  )?;

and the error is "ddKnNBKgdFQzqWLrmnxL1SHSsQU89jLeW9oEQiWp5r3's writable privilege escalated" ddKn is the authority of the PDA. (pda token auhority in my code). The signer seeds should be correct since when i use Pubkey::find_program_address i get the right public key. The account (pda authority) should be sent as a signer since i use "true" in the AccountMeta, and i use invoke_signed.

So i don't get why i have this error... Here is a failed transaction example: https://explorer.solana.com/tx/4gZfKHavQR6Zx48kqYPMNRVUEsvzHpHBe7J4o74NLjP98LhaWMpCgsi5kAy32ECSpWrFQrqfFMz8bYBeczyFaMe8?cluster=devnet

Also, i'm pretty sure the code used to transfer is correct since i used it to send the nft to the PDA, and it worked properly. The only difference was that i used invoke and not invoke_signed because the authority was aleady signing the transaction (it was a user).

Any idea ?

Answer 1

i found the problem!

AccountMeta::new(ctx.accounts.pda_token_authority.key(), true)

pda_token_authority doesn't really exists, it's just a signer for the program's PDA. Thus i guess i can't use it as a writtable account,and needed to use new_readonly instead of new.

It works well now.