@ignitionfi/spl-stake-pool 1.1.14 → 1.1.16

package/dist/index.browser.cjs.js

@@ -1468,6 +1468,7 @@ class StakePoolInstruction {
             { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
             { pubkey: params.programSigner, isSigner: false, isWritable: true },
             { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.fundingAccount, isSigner: true, isWritable: true },
+            { pubkey: splToken.ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false },
         ];
         if (params.depositAuthority) {
             keys.push({
@@ -1857,13 +1858,11 @@ async function depositWsolWithSession(connection, stakePoolAddress, signerOrSess
     const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
     const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
     const stakePool = stakePoolAccount.account.data;
-    // stakePool.tokenProgramId
     const instructions = [];
-    // Create token account if not specified
+    // The program handles ATA creation internally using funds from the user's deposit
+    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
     if (!destinationTokenAccount) {
-        const associatedAddress = splToken.getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
-        instructions.push(splToken.createAssociatedTokenAccountIdempotentInstruction(payer !== null && payer !== void 0 ? payer : signerOrSession, associatedAddress, userPubkey, stakePool.poolMint));
-        destinationTokenAccount = associatedAddress;
+        destinationTokenAccount = splToken.getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
     }
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     const [programSigner] = web3_js.PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
@@ -2164,14 +2163,7 @@ async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSes
     const userWsolAccount = splToken.getAssociatedTokenAddressSync(splToken.NATIVE_MINT, userPubkey);
     const instructions = [];
     const signers = [];
-    // instructions.push(
-    //   createAssociatedTokenAccountIdempotentInstruction(
-    //     signerOrSession,
-    //     userWsolAccount,
-    //     userPubkey,
-    //     NATIVE_MINT,
-    //   ),
-    // )
+    instructions.push(splToken.createAssociatedTokenAccountIdempotentInstruction(signerOrSession, userWsolAccount, userPubkey, splToken.NATIVE_MINT));
     const [programSigner] = web3_js.PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     instructions.push(StakePoolInstruction.withdrawWsolWithSession({