Pros and cons: Ownership check Vs Pubkey Check

Question

I have been sifting through a lot of code on Solana Recently, and I noticed that on a lot of code bases, people just do ownership checks, and don't go beyond just that.

my questions are:

1.) If I do a Pubkey check, i.e. Accountinfo.key == &find_program_address(&[seed], program_id), is Ownership check really necessary anymore?

2.) Why go with Ownership over Pubkey, when Pubkey is the only one that prevents program ownership, yet wrong account for the specific instruction in question, which could in turn end up being a malevolent input, even just to wreak havoc?

Answer 1

This is conflating an account's address with the use of a PDA, which is not a strict requirement. Any ed25519 keypair can also be used to claim an address at the public key's value. That is, while all Pubkeys can be addresses, not all addresses are Pubkeys. This is a prime example of the Solana ecosystem using words wrong

1. It's true that recovering a PDA from its seeds is an implicit check on the owning program given the address derivation scheme. Finding a collision here is synonymous with mounting a second preimage attack against SHA256

2. The ownership check is more than just verifying that two addresses match, it's ensuring that the data an account holds has only ever been manipulated by the expected program

I agree with @nabeel-naveed, the ownership check should always be explicitly performed, if for no other reason than to make the code completely clear.

Answer 2

TLDR : You should do both(to be on the safe side).

1. this works as long as you always used the canonical bump , this is what anchor does too, if you dont specify a deserialized account type, and add a seed check on an UncheckedAccount, because only the intended program can create a pda via system account and sign for it , i guess the ownership check is not that important in the case of pda's, happy to be proven wrong here as if the program is not a owner it will never be able to sign for it or write data to it, and find program address will return the programs own pda as long -as the program id u pass is of the executing program.
2. This i believe is useful for e.g with the token program you have a wallet associated pda account or a normal account, it is essential to check the owner is token program as only token program can write to an account it owns , otherwise any one can create a program write to it arbitarily/maliciously also the pubkey check would be too restricted i.e would act as a whitelist and would be something you verify on your end, for example the associated token account could be a pubkey check since its a pda where the wallet address is one of the seed, pubkey check makes more sense if you are 100% sure the pubkey is a pda.