I'm fetching data from an on-chain program and want to be sure it's really coming from said program and not being manipulated via some man-in-the-middle attack or so. I know the public key of the on-chain program. Generally, if I want to prove a certain message comes from a certain public key, I'd sign that message with the belonging private key. Unfortunately, if I have a Solana program there is no private key to my account public key. Is there some other way I can (in the best case cryptographically) prove a piece of data truly came from my program?
2 Answers
A man-in-the-middle attack can be prevented by using a trusted rpc node through https with tls. This will inherently prevent this attack. If you don't have a trusted node you will need to run your own.
User data from an on-chain program is typically stored in PDAs (Program Derived Addresses). Only your specific program can write data to this deterministic address, no other program. So you can always determine with the seeds and bumps how to derive the PDA.
Secondly, make sure you use a RPC provider you trust, via a secured (https/wss) connection.
And third, use finalized commitment level when fetching account data to ensure the data is validated.
