basics/pda-rent-payer: create_new_account has no caller check — worth a note for people copying it?

未关闭 适合新手
  • 哪里不对？
#671 3 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

@khoap1220-hue 已经在做这个了。

开始于 2026年10月25日。

  • #732 来自 @devtechedge —— 已关闭，未合并
  • #760 来自 @khoap1220-hue —— 未关闭

评估

难度
1/5
预计耗时
1 小时以内
新手友好度
78/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
冷清
技术栈
blockchain, rust
领域
documentation, security

调研方向

从 basics/pda-rent-payer 中的 create_new_account accounts struct 开始，然后对比 basics/checking-accounts 中关于 Authority 的指导。只添加已同意的说明性注释或交叉引用，同时保留示例有意不受限制的行为；当 caller-check 的限制以及现实场景中更安全的替代方案对读者来说都清晰时，即视为完成。

由索引模型根据 Issue 内容生成。

描述

create_new_account spends from a program-owned vault, and nothing in the
instruction constrains who may call it.

The accounts struct is:

pub struct CreateNewAccount<'info> {
    #[account(mut)]
    new_account: Signer<'info>,

    #[account(mut, seeds = [b"rent_vault"], bump)]
    rent_vault: SystemAccount<'info>,
    system_program: Program<'info, System>,
}

new_account is a Signer, but it signs for itself — it is the account being
created, and the caller generates that keypair. rent_vault is a PDA on a
single literal seed, shared by everyone. So there is no authority account and
no has_one, and each call moves one rent-exempt minimum out of the shared
vault into an account the caller controls.

That is almost certainly intentional for the example's purpose — it exists to
show a PDA signing for itself, and it does that cleanly and readably. My
question is only about the people who copy it, since a rent vault is exactly
the kind of helper that gets lifted into a real program.

Would a short comment on the accounts struct be welcome? Something like:

// NOTE: this example does not restrict who may call it. A real rent vault
// needs an authority check — a `has_one` against an admin recorded at
// initialisation, seeds that bind the vault to one funder, or a per-caller
// limit. (A bare `authority: Signer` alone is not enough — any keypair
// can sign for itself.)

Happy to open a PR with just that comment if it's useful. I did not want to add
a constraint, since that would change what the example teaches.

For context: basics/checking-accounts is the example that teaches exactly this
check, so a pointer between the two might do the job on its own.

主要语言
Rust
星标
1.4k
派生
559
平均合并
20 小时 9 分钟
30 天内合并 PR
17

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

solana-foundation/program-examples 的其他 Issue

查看 solana-foundation/program-examples 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。