2

Given a cross program invocation, is it safe to assume that constraining the Instruction is enough to prevent any undesired effect?

As in validating only program id, accounts and data.

So if Vec<AccountMeta> is considered correct, can someone do anything incorrect by providing another slice of account_infos: &[AccountInfo] at the top level?

The invoke function https://docs.rs/solana-program/1.11.5/solana_program/program/fn.invoke.html

1 Answer 1

1

is it safe to assume that constraining the Instruction is enough to prevent any undesired effect?

Calling a program via CPI is the same as (or can be treated the same as) having the instruction at the top level. So to the program that is "invoked", there's no difference, so as much as you can validate the inputs before making the CPI, the program that is invoked has to validate all the inputs as normal.

So you validating those inputs won't prevent any "undesired effect", the invoked program itself needs to validate (which it would be regardless of being called via CPI, there no distinction between being invoked via CPI or -- normal)

can someone do anything incorrect by providing another slice of &[AccountInfo] at the top level?

Potentially, it depends if there's a relation between the top level accounts and the instruction for the CPI.

e.g.:

  • Account A gets passed in top level to Program A
  • Account A not properly validated by Program A
  • Incorrect state change in Account A occurs
  • Account A is also used in CPI instruction to Program B
  • Due to incorrect state on Account A
  • Program B uses the incorrect state in Account A to do something -- incorrect
2
  • The question is more around the fact that you can create a CPI with some Vec<AccountMeta> but provided extra/omit accounts &[AccountInfo]
    – Arowana
    Aug 16 at 10:00
  • Oh, you can pass in extra, but you wont be able to omit. The constraints are the same, invoke still requires all the accounts needed by the instruction to be passed in
    – C.OG
    Aug 16 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.