0

Is it possible to convert a system program owned account which has sol and other spl tokens in it to a custom program owned account and still retain all the items the account previously had?

Improve this question

1 Answer 1

Reset to default
1

It's possible, but you may see some unexpected behavior. Let's say you have an account A, which is currently owned by the system program, and also is marked as the owner of a few SPL token accounts.

If you assign account A to some other program, then that program will be able to change its data and move its SOL, per the normal Solana ownership model: https://docs.solana.com/developing/programming-model/accounts#ownership-and-assignment-to-programs

However, the private key for A will still be able to authorize transfers of the SPL tokens that it owns, and not the program it is assigned to. This is because the SPL token program just looks for a signature from the owner, and it's still possible to generate valid signatures for A.

To properly solve this problem, you should move everything to be owned by program-derived addresses: https://docs.solana.com/developing/programming-model/calling-between-programs#program-derived-addresses -- this way, only the program can "sign" for the assets.

Improve this answer
2
  • I have a discord based wallet system which stores wallet pk’s nd ties them to users which is not really web3 thing to do. Now I want to create a custom program and assign accounts to users under that program. But the problem is being in discord, people can’t sign tx’s with their wallet which will require them to go to external link and I really don’t want that. What would be the best way to provide users an account under the custom program to use and still keep it secure from being accessed anyone other than that person? And without storing anything sensitive in local db?
    – Muhit Raihan
    Commented Jan 3 at 22:39
  • If you want to validate user actions, you have two main options: they sign transactions themselves, which requires them to store the private key on their side, or you need to have an external authentication service for them to access. In the second case, you'd be managing their funds, which might cause regulatory issues depending on your jurisdiction. If you can find a way to go with the first way, through self-custody, then you can provide a more web3-style experience. All that to say: it's a hard problem!
    – Jon C
    Commented Jan 4 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.