@ignitionfi/spl-stake-pool 1.1.14 → 1.1.16

package/dist/index.browser.esm.js

@@ -1,4 +1,4 @@
-import { TOKEN_PROGRAM_ID, getAssociatedTokenAddressSync, createAssociatedTokenAccountIdempotentInstruction, NATIVE_MINT, getAccount, createApproveInstruction } from '@solana/spl-token';
+import { TOKEN_PROGRAM_ID, ASSOCIATED_TOKEN_PROGRAM_ID, getAssociatedTokenAddressSync, createAssociatedTokenAccountIdempotentInstruction, NATIVE_MINT, getAccount, createApproveInstruction } from '@solana/spl-token';
 import { PublicKey, LAMPORTS_PER_SOL, StakeProgram, Keypair, SystemProgram, SYSVAR_RENT_PUBKEY, SYSVAR_CLOCK_PUBKEY, SYSVAR_STAKE_HISTORY_PUBKEY, STAKE_CONFIG_ID, TransactionInstruction, StakeAuthorizationLayout } from '@solana/web3.js';
 import BN from 'bn.js';
 import { Buffer as Buffer$1 } from 'node:buffer';
@@ -1447,6 +1447,7 @@ class StakePoolInstruction {
             { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
             { pubkey: params.programSigner, isSigner: false, isWritable: true },
             { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.fundingAccount, isSigner: true, isWritable: true },
+            { pubkey: ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false },
         ];
         if (params.depositAuthority) {
             keys.push({
@@ -1836,13 +1837,11 @@ async function depositWsolWithSession(connection, stakePoolAddress, signerOrSess
     const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
     const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
     const stakePool = stakePoolAccount.account.data;
-    // stakePool.tokenProgramId
     const instructions = [];
-    // Create token account if not specified
+    // The program handles ATA creation internally using funds from the user's deposit
+    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
     if (!destinationTokenAccount) {
-        const associatedAddress = getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
-        instructions.push(createAssociatedTokenAccountIdempotentInstruction(payer !== null && payer !== void 0 ? payer : signerOrSession, associatedAddress, userPubkey, stakePool.poolMint));
-        destinationTokenAccount = associatedAddress;
+        destinationTokenAccount = getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
     }
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     const [programSigner] = PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
@@ -2143,14 +2142,7 @@ async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSes
     const userWsolAccount = getAssociatedTokenAddressSync(NATIVE_MINT, userPubkey);
     const instructions = [];
     const signers = [];
-    // instructions.push(
-    //   createAssociatedTokenAccountIdempotentInstruction(
-    //     signerOrSession,
-    //     userWsolAccount,
-    //     userPubkey,
-    //     NATIVE_MINT,
-    //   ),
-    // )
+    instructions.push(createAssociatedTokenAccountIdempotentInstruction(signerOrSession, userWsolAccount, userPubkey, NATIVE_MINT));
     const [programSigner] = PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     instructions.push(StakePoolInstruction.withdrawWsolWithSession({