I had heard that all accounts that are passed into the Accounts struct are enforced to be owned by the program, but that evidently seems to be false
Add a comment
|
2 Answers
Answering the question posed in the body of the text, more so than the title of the post.
Any account in the account struct that uses the syntax this_account: Account<'info, ThisAccount> will ensure that this_account is owned by a specific program. In most cases the program it checks is the current executing program, e.g. crate::ID but for special types of accounts, e.g. Mint or TokenAccount it will ensure the accounts are owned by the SPL token program or whatever other program the account comes from.
-
-
Yes, either a struct decorated with the
#[account]macro or a manually created account, like the spl token accounts– Henry ECommented Jul 25, 2022 at 8:15
https://github.com/coral-xyz/sealevel-attacks
There's a pretty comprehensive list of how Anchor makes Solana programs safer by doing a lot of checks for you.
As to the other question, not all accounts you use in your program are owned by it. Anchor does verify that the type of accounts you pass into your validator are owned by your program, but for imported types it does the same verification to enforce that those types are owned by the program they're imported from.
