0

For security reasons, I know that we should check for the account owner of certain accounts. Although, if I recall correctly, Anchor already does this by default?

1 Answer 1

2

It depends how you load the account in the account context.

Account (docs.rs)

Wrapper around AccountInfo that verifies program ownership and deserializes underlying data into a Rust type.

pub escrow: Account<'info, TokenAccount>,

AccountLoader (docs.rs)

Type facilitating on demand zero copy deserialization. Will check the owner and discriminator.

pub state: AccountLoader<'info, VrfClient>,

AccountInfo (docs.rs)

No checks, loaded straight from the slot leader processing your transaction.

#[account(signer)]
pub authority: AccountInfo<'info>,
1
  • After all this time, I think I finally get it. The AccountLoader will only check for ownership after a load or load_mut is called (thus being on-demand) - will fail during execution. Unlike the Account which will check before Tx execution - will fail before execution?
    – Burger Bob
    Jan 19, 2023 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.