interface: Demote all signers during onchain invoke#83
interface: Demote all signers during onchain invoke#83joncinque wants to merge 4 commits intosolana-program:mainfrom
Conversation
#### Problem There's just too many ways for signers to be potentially abused during transfer hooks. #### Summary of changes Demote all accounts to non-signer before invoking the transfer hook program.
buffalojoec
left a comment
There was a problem hiding this comment.
The change itself is fine, but we have a bit of a confusing dependency tree going for transfer-hook, and the leaf (tlv-account-resolution) actually has a method that's supposed to do some of this work under the hood.
Maybe it's best to include this change there instead?
|
My thinking was that TLV account resolution could be used for other use-cases, outside of transfer hook programs, so that it would be better to fix it only at the level that we were worried about, which was transfer hooks. After writing it out though, I realize that's kind of silly -- we can always add new functions in TLV account resolution later if needed. |
#### Problem As described at solana-program/transfer-hook#83, there's just too many ways for signers to be potentially abused during transfer hooks. #### Summary of changes Demote all accounts to non-signer when resolving from an extra account metas list.
Agreed, we can just hoist |
* tlv-account-resolution: Always demote signer flag #### Problem As described at solana-program/transfer-hook#83, there's just too many ways for signers to be potentially abused during transfer hooks. #### Summary of changes Demote all accounts to non-signer when resolving from an extra account metas list. * Review feedback
Problem
There's just too many ways for signers to be potentially abused during transfer hooks.
Summary of changes
Demote all accounts to non-signer before invoking the transfer hook program. Let me know if you think the test is useless, I just wanted to be sure that the code was correct.
At the same time, remove cdylib target for the interface crate, and
remove the lib target for the program crate.NOTE: can't do the second onecc @tiago18c