merkle-tree-token-claimer: create PDAs over a pre-funded address

Receipt and airdrop-state addresses are publicly derivable, and
CreateAccount refuses to create over an account that already holds
lamports. Anyone could therefore send a lamport to a receipt address and
block that index's claim permanently.

Top the account up, then Allocate and Assign — the same fallback Anchor's
init performs.

Author: MarkFeder

tokens/merkle-tree-token-claimer/pinocchio/program/src/instructions/claim_airdrop.rs

@@ -1,18 +1,17 @@
 use pinocchio::{
     cpi::{Seed, Signer},
     error::ProgramError,
-    sysvars::{rent::Rent, Sysvar},
     AccountView, Address, ProgramResult,
 };
 use pinocchio_associated_token_account::instructions::CreateIdempotent;
 use pinocchio_log::log;
-use pinocchio_system::instructions::CreateAccount;
 use pinocchio_token::instructions::TransferChecked;
 
 use crate::{
     error::ClaimError,
     merkle::compute_merkle_root,
     state::{AirdropState, ClaimReceipt, AIRDROP_STATE_SEED, CLAIM_RECEIPT_SEED, CLAIM_RECEIPT_SIZE, MINT_DECIMALS},
+    util::create_pda_account,
 };
 
 /// Pays out one leaf of the airdrop.
@@ -124,14 +123,7 @@ pub fn claim_airdrop(program_id: &Address, accounts: &mut [AccountView], data: &
             Seed::from(&receipt_bump_bytes),
         ];
 
-        CreateAccount {
-            from: signer,
-            to: claim_receipt,
-            lamports: Rent::get()?.try_minimum_balance(CLAIM_RECEIPT_SIZE)?,
-            space: CLAIM_RECEIPT_SIZE as u64,
-            owner: program_id,
-        }
-        .invoke_signed(&[Signer::from(&receipt_seeds)])?;
+        create_pda_account(signer, claim_receipt, CLAIM_RECEIPT_SIZE, program_id, &receipt_seeds)?;
     }
 
     CreateIdempotent {

tokens/merkle-tree-token-claimer/pinocchio/program/src/instructions/initialize_airdrop_data.rs

@@ -1,5 +1,5 @@
 use pinocchio::{
-    cpi::{Seed, Signer},
+    cpi::Seed,
     error::ProgramError,
     sysvars::{rent::Rent, Sysvar},
     AccountView, Address, ProgramResult,
@@ -12,6 +12,7 @@ use pinocchio_token::instructions::{AuthorityType, InitializeMint2, MintTo, SetA
 use crate::{
     error::ClaimError,
     state::{AirdropState, AIRDROP_STATE_SEED, AIRDROP_STATE_SIZE, MINT_DECIMALS},
+    util::create_pda_account,
 };
 
 /// Size of a legacy SPL Token mint.
@@ -83,14 +84,7 @@ pub fn initialize_airdrop_data(program_id: &Address, accounts: &mut [AccountView
     let state_bump_bytes = [state_bump];
     let state_seeds =
         [Seed::from(AIRDROP_STATE_SEED), Seed::from(mint.address().as_ref()), Seed::from(&state_bump_bytes)];
-    CreateAccount {
-        from: authority,
-        to: airdrop_state,
-        lamports: rent.try_minimum_balance(AIRDROP_STATE_SIZE)?,
-        space: AIRDROP_STATE_SIZE as u64,
-        owner: program_id,
-    }
-    .invoke_signed(&[Signer::from(&state_seeds)])?;
+    create_pda_account(authority, airdrop_state, AIRDROP_STATE_SIZE, program_id, &state_seeds)?;
 
     AirdropState::from_bytes(&mut airdrop_state.try_borrow_mut()?)?.initialize(
         &merkle_root,

tokens/merkle-tree-token-claimer/pinocchio/program/src/lib.rs

@@ -5,6 +5,7 @@ pub mod instructions;
 pub mod merkle;
 pub mod processor;
 pub mod state;
+pub mod util;
 
 use pinocchio::{entrypoint, nostd_panic_handler};
 

tokens/merkle-tree-token-claimer/pinocchio/program/src/util.rs

@@ -0,0 +1,38 @@
+//! Shared account-creation helper.
+
+use pinocchio::{
+    cpi::{Seed, Signer},
+    sysvars::{rent::Rent, Sysvar},
+    AccountView, Address, ProgramResult,
+};
+use pinocchio_system::instructions::{Allocate, Assign, Transfer};
+
+/// Creates `account` at a PDA, tolerating an address that already holds
+/// lamports.
+///
+/// `CreateAccount` fails outright if the target has a balance, and every PDA
+/// here has a publicly derivable address — so anyone could send one lamport to
+/// a receipt or state address and permanently block the instruction that was
+/// meant to create it. Topping the account up and then allocating and assigning
+/// it separately sidesteps that; it is the same fallback Anchor's `init`
+/// performs.
+pub fn create_pda_account(
+    payer: &AccountView,
+    account: &mut AccountView,
+    space: usize,
+    owner: &Address,
+    seeds: &[Seed],
+) -> ProgramResult {
+    let required = Rent::get()?.try_minimum_balance(space)?;
+    let current = account.lamports();
+
+    if current < required {
+        Transfer { from: payer, to: account, lamports: required - current }.invoke()?;
+    }
+
+    let signer = [Signer::from(seeds)];
+    Allocate { account, space: space as u64 }.invoke_signed(&signer)?;
+    Assign { account, owner }.invoke_signed(&signer)?;
+
+    Ok(())
+}

tokens/merkle-tree-token-claimer/pinocchio/tests/test.ts

@@ -325,8 +325,40 @@ describe('Merkle Tree Token Claimer (Pinocchio)', () => {
         assert.deepEqual(Array.from(airdropStateData().merkleRoot), Array.from(tree.root), 'the root is unchanged');
     });
 
+    it('Pays a claim whose receipt address was pre-funded', async () => {
+        // Receipt addresses are publicly derivable, so anyone can drop lamports
+        // on one before the rightful claimant gets there. `CreateAccount`
+        // refuses to create over an existing balance, so a bare create here
+        // would let an attacker permanently block any index for a few lamports.
+        const index = 1;
+        const claimer = claimers[index];
+        const receipt = await receiptAddress(BigInt(index));
+        svm.setAccount({
+            address: receipt,
+            data: new Uint8Array(0),
+            executable: false,
+            lamports: lamports(1n),
+            programAddress: SYSTEM_PROGRAM_ADDRESS,
+            space: 0n,
+        });
+
+        const ix = await claimIx(claimer, index, CLAIM_AMOUNTS[index], tree.proof(index));
+        send(await tx([ix], claimer), 'claim over a pre-funded receipt');
+
+        const [claimerAta] = await findAssociatedTokenPda({
+            owner: claimer.address,
+            mint: mint.address,
+            tokenProgram: TOKEN_PROGRAM_ADDRESS,
+        });
+        assert.equal(tokenAmount(claimerAta), CLAIM_AMOUNTS[index], 'the claim was still paid');
+
+        const receiptAccount = svm.getAccount(receipt);
+        if (!receiptAccount?.exists) throw new Error('receipt not found');
+        assert.equal(receiptAccount.programAddress, programId, 'the receipt ended up owned by the program');
+    });
+
     it('Pays the remaining claims', async () => {
-        for (const index of [1, 2]) {
+        for (const index of [2]) {
             const claimer = claimers[index];
             const ix = await claimIx(claimer, index, CLAIM_AMOUNTS[index], tree.proof(index));
             send(await tx([ix], claimer), `claim ${index}`);