Understanding uses of on-curve token accounts

Question

I'm trying to understand the specific differences between token account creation methods, and the differing implementation details between apps. Specifically, why a token account in a transaction would be marked as on-curve.

Some apps will use createAccount and then initializeAccount3, and other times createIdempotent is used. The first case will sometimes include an extra signer on the transaction for the token account, which is a related point of confusion.

What are the differences between these implementations? Why is it that some apps using createAccount and then initializeAccount3 will include an extra signer with an on-curve address?

Answer 1

createIdempotent will search for the existence of a token account for the given mint and owner, and conduct the necessary creation actions if needed (using initializeAccount3 and any complimentary instructions).

Generally, initializeAccount3 will be used with a derived PDA, so it will be off-curve, and the relevant program will sign for it.

In the case of an on-curve token account that's marked as a signer, we're dealing with what's referred to as an "ephemeral signer". These are generated, short-lived keypairs that sign a transaction for some purpose (in this case to serve as a token account), and are thrown out after. This is advantageous in the case that you need to conduct some action with an account that will only be of importance for the life of the transaction. Wrapped SOL account handling in DeFi protocols is a place where you'd find something like this used.

Not all token accounts will be PDAs, and sometimes it works in favor for them not to be.