Is the Instruction argument of a CPI enough to protect against undesired behaviour?

Question

Given a cross program invocation, is it safe to assume that constraining the Instruction is enough to prevent any undesired effect?

As in validating only program id, accounts and data.

So if Vec<AccountMeta> is considered correct, can someone do anything incorrect by providing another slice of account_infos: &[AccountInfo] at the top level?

The invoke function https://docs.rs/solana-program/1.11.5/solana_program/program/fn.invoke.html

Answer 1

is it safe to assume that constraining the Instruction is enough to prevent any undesired effect?

Calling a program via CPI is the same as (or can be treated the same as) having the instruction at the top level. So to the program that is "invoked", there's no difference, so as much as you can validate the inputs before making the CPI, the program that is invoked has to validate all the inputs as normal.

So you validating those inputs won't prevent any "undesired effect", the invoked program itself needs to validate (which it would be regardless of being called via CPI, there no distinction between being invoked via CPI or -- normal)

can someone do anything incorrect by providing another slice of &[AccountInfo] at the top level?

Potentially, it depends if there's a relation between the top level accounts and the instruction for the CPI.

e.g.:

• Account A gets passed in top level to Program A
• Account A not properly validated by Program A
• Incorrect state change in Account A occurs
• Account A is also used in CPI instruction to Program B
• Due to incorrect state on Account A
• Program B uses the incorrect state in Account A to do something -- incorrect