@ignitionfi/spl-stake-pool 1.1.14 → 1.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ignitionfi/spl-stake-pool",
-  "version": "1.1.14",
+  "version": "1.1.16",
   "description": "Ignition Stake Pool SDK for FOGO",
   "contributors": [
     "Anza Maintainers <maintainers@anza.xyz>",

package/src/index.ts

@@ -323,25 +323,15 @@ export async function depositWsolWithSession(
   const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint)
   const stakePool = stakePoolAccount.account.data
 
-  // stakePool.tokenProgramId
-
   const instructions: TransactionInstruction[] = []
 
-  // Create token account if not specified
+  // The program handles ATA creation internally using funds from the user's deposit
+  // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
   if (!destinationTokenAccount) {
-    const associatedAddress = getAssociatedTokenAddressSync(
+    destinationTokenAccount = getAssociatedTokenAddressSync(
       stakePool.poolMint,
       userPubkey,
     )
-    instructions.push(
-      createAssociatedTokenAccountIdempotentInstruction(
-        payer ?? signerOrSession,
-        associatedAddress,
-        userPubkey,
-        stakePool.poolMint,
-      ),
-    )
-    destinationTokenAccount = associatedAddress
   }
 
   const withdrawAuthority = await findWithdrawAuthorityProgramAddress(
@@ -857,14 +847,14 @@ export async function withdrawWsolWithSession(
   const instructions: TransactionInstruction[] = []
   const signers: Signer[] = []
 
-  // instructions.push(
-  //   createAssociatedTokenAccountIdempotentInstruction(
-  //     signerOrSession,
-  //     userWsolAccount,
-  //     userPubkey,
-  //     NATIVE_MINT,
-  //   ),
-  // )
+  instructions.push(
+    createAssociatedTokenAccountIdempotentInstruction(
+      signerOrSession,
+      userWsolAccount,
+      userPubkey,
+      NATIVE_MINT,
+    ),
+  )
 
   const [programSigner] = PublicKey.findProgramAddressSync(
     [Buffer.from('fogo_session_program_signer')],

package/src/instructions.ts

@@ -1,5 +1,5 @@
 import * as BufferLayout from '@solana/buffer-layout'
-import { TOKEN_PROGRAM_ID } from '@solana/spl-token'
+import { ASSOCIATED_TOKEN_PROGRAM_ID, TOKEN_PROGRAM_ID } from '@solana/spl-token'
 import {
   PublicKey,
   STAKE_CONFIG_ID,
@@ -992,6 +992,7 @@ export class StakePoolInstruction {
       { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
       { pubkey: params.programSigner, isSigner: false, isWritable: true },
       { pubkey: params.payer ?? params.fundingAccount, isSigner: true, isWritable: true },
+      { pubkey: ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false },
     ]
 
     if (params.depositAuthority) {