token-2022 transfer-hook transfer-cost: create PDAs over a pre-funded address

Author: MarkFeder

tokens/token-2022/transfer-hook/transfer-cost/pinocchio/program/src/instructions/initialize_extra_account_meta_list.rs

@@ -1,20 +1,15 @@
 use alloc::vec::Vec;
 
-use pinocchio::{
-    cpi::{Seed, Signer},
-    error::ProgramError,
-    sysvars::{rent::Rent, Sysvar},
-    AccountView, Address, ProgramResult,
-};
+use pinocchio::{cpi::Seed, error::ProgramError, AccountView, Address, ProgramResult};
 use pinocchio_log::log;
-use pinocchio_system::instructions::CreateAccount;
 
 use crate::{
     error::TransferHookError,
     instructions::{
         ASSOCIATED_TOKEN_PROGRAM_ID, COUNTER_SEED, COUNTER_SIZE, EXTRA_ACCOUNT_METAS_SEED, NATIVE_MINT,
         SPL_TOKEN_PROGRAM_ID,
     },
+    util::create_pda_account,
 };
 
 /// `Execute`'s TLV discriminator, which keys the `ExtraAccountMetaList` entry.
@@ -142,11 +137,9 @@ pub fn initialize_extra_account_meta_list(program_id: &Address, accounts: &mut [
     let seeds = [Seed::from(EXTRA_ACCOUNT_METAS_SEED), Seed::from(mint.address().as_ref()), Seed::from(&bump_bytes)];
 
     let metas = build_extra_account_metas();
-    let lamports = Rent::get()?.try_minimum_balance(metas.len())?;
 
     log!("Creating extra account meta list");
-    CreateAccount { from: payer, to: extra_account_meta_list, lamports, space: metas.len() as u64, owner: program_id }
-        .invoke_signed(&[Signer::from(&seeds)])?;
+    create_pda_account(payer, extra_account_meta_list, metas.len(), program_id, &seeds)?;
 
     let mut account_data = extra_account_meta_list.try_borrow_mut()?;
     account_data.copy_from_slice(&metas);
@@ -167,14 +160,7 @@ pub fn initialize_extra_account_meta_list(program_id: &Address, accounts: &mut [
         let counter_seeds = [Seed::from(COUNTER_SEED), Seed::from(&counter_bump_bytes)];
 
         log!("Creating counter");
-        CreateAccount {
-            from: payer,
-            to: counter,
-            lamports: Rent::get()?.try_minimum_balance(COUNTER_SIZE)?,
-            space: COUNTER_SIZE as u64,
-            owner: program_id,
-        }
-        .invoke_signed(&[Signer::from(&counter_seeds)])?;
+        create_pda_account(payer, counter, COUNTER_SIZE, program_id, &counter_seeds)?;
     } else if !counter.owned_by(program_id) || counter.data_len() != COUNTER_SIZE {
         return Err(TransferHookError::InvalidCounterAccount.into());
     }

tokens/token-2022/transfer-hook/transfer-cost/pinocchio/program/src/lib.rs

@@ -9,6 +9,7 @@ pub mod error;
 pub mod instructions;
 pub mod processor;
 pub mod token2022;
+pub mod util;
 
 use pinocchio::{entrypoint, nostd_panic_handler};
 

tokens/token-2022/transfer-hook/transfer-cost/pinocchio/program/src/util.rs

@@ -0,0 +1,38 @@
+//! Shared account-creation helper.
+
+use pinocchio::{
+    cpi::{Seed, Signer},
+    sysvars::{rent::Rent, Sysvar},
+    AccountView, Address, ProgramResult,
+};
+use pinocchio_system::instructions::{Allocate, Assign, Transfer};
+
+/// Creates `account` at a PDA, tolerating an address that already holds
+/// lamports.
+///
+/// `CreateAccount` fails outright if the target has a balance, and every PDA
+/// here has a publicly derivable address — so anyone could send one lamport to
+/// one of these addresses and permanently block the instruction that was
+/// meant to create it. Topping the account up and then allocating and assigning
+/// it separately sidesteps that; it is the same fallback Anchor's `init`
+/// performs.
+pub fn create_pda_account(
+    payer: &AccountView,
+    account: &mut AccountView,
+    space: usize,
+    owner: &Address,
+    seeds: &[Seed],
+) -> ProgramResult {
+    let required = Rent::get()?.try_minimum_balance(space)?;
+    let current = account.lamports();
+
+    if current < required {
+        Transfer { from: payer, to: account, lamports: required - current }.invoke()?;
+    }
+
+    let signer = [Signer::from(seeds)];
+    Allocate { account, space: space as u64 }.invoke_signed(&signer)?;
+    Assign { account, owner }.invoke_signed(&signer)?;
+
+    Ok(())
+}

tokens/token-2022/transfer-hook/transfer-cost/pinocchio/tests/test.ts

@@ -297,6 +297,21 @@ describe('Token-2022 Transfer Hook — Transfer Cost (Pinocchio)', () => {
     });
 
     it('Creates the ExtraAccountMetaList account', async () => {
+        // Both PDAs below have publicly derivable addresses, and `CreateAccount`
+        // refuses to create over an account that already holds lamports — so a
+        // stray lamport on either would otherwise block setup for this mint
+        // permanently. Drop one on each first.
+        for (const address of [extraAccountMetaList, counter]) {
+            svm.setAccount({
+                address,
+                data: new Uint8Array(0),
+                executable: false,
+                lamports: lamports(1n),
+                programAddress: SYSTEM_PROGRAM_ADDRESS,
+                space: 0n,
+            });
+        }
+
         const ix = {
             programAddress: programId,
             accounts: [