4

I had heard that all accounts that are passed into the Accounts struct are enforced to be owned by the program, but that evidently seems to be false

2 Answers 2

6

Answering the question posed in the body of the text, more so than the title of the post.

Any account in the account struct that uses the syntax this_account: Account<'info, ThisAccount> will ensure that this_account is owned by a specific program. In most cases the program it checks is the current executing program, e.g. crate::ID but for special types of accounts, e.g. Mint or TokenAccount it will ensure the accounts are owned by the SPL token program or whatever other program the account comes from.

2
  • ThisAccount being a program specific struct? Jul 25, 2022 at 7:13
  • Yes, either a struct decorated with the #[account] macro or a manually created account, like the spl token accounts
    – Henry E
    Jul 25, 2022 at 8:15
3

https://github.com/coral-xyz/sealevel-attacks

There's a pretty comprehensive list of how Anchor makes Solana programs safer by doing a lot of checks for you.

As to the other question, not all accounts you use in your program are owned by it. Anchor does verify that the type of accounts you pass into your validator are owned by your program, but for imported types it does the same verification to enforce that those types are owned by the program they're imported from.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.