In the Rust crate, there are create_program_address and find_program_address. When using Anchor, I have seen both of them being used for doing address matching.
Noticeably, find_program_address does not use the bump for recreating the address, whereas create_program_address takes the bump as input.
So I was wondering if I should be using one over the other for address matching/checking?
When checking if some account matches an expected derived PDA, you can use either. find_program_address consumes more CUs, so create_program_address is preferred when the bump is available.
It's common to see bumps stored on your account struct for this reason: quick validation with create_program_address, or for passing as signer seeds with PDA-owned accounts.
They serve different purposes and depends on your context you can decide which one to use or a combination of both.
create_program_address is for creating PDA with provided seeds and bump
Checking PDA created from provided seeds and bump matches canonical bump PDA. Will return error if provided seed result in an invalid PDA (on-curve).
let (expected_pda, bump_seed) = Pubkey::find_program_address(&[b"vault"], &program_id);
let actual_pda = Pubkey::create_program_address(&[b"vault", &[provided_bump]], &program_id)?;
assert_eq!(expected_pda, actual_pda);
find_program_address is for finding canonical bump PDA
Checking provided PDA matches canonical bump PDA
let (canonical_bump_pda, canonical_bump) = Pubkey::find_program_address(&[b"vault"], &program_id);
assert_eq!(canonical_bump_pda, provided_pda);
find_program_address may consume a variable Compute Units due to possible additional computation needed to find an off-curve PDA. This should be aware in CUs sensitive context such as onchain program.
You always have to consider security issues. For instance. If bump seed validation is not applied, and the bump seed is untrusted data, it can lead to Bump seed canonicalization (security issue). create_program_address function will generate a different PDA for the same program id if the bump seed is different and does not perform any validation on the bump seed. Meanwhile find_program_address returns a PDA using the maximum valid bump seed.
