@ignitionfi/spl-stake-pool 1.1.14 → 1.1.16

package/dist/index.iife.js

@@ -22649,6 +22649,7 @@ var solanaStakePool = (function (exports, node_buffer) {
 	            { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
 	            { pubkey: params.programSigner, isSigner: false, isWritable: true },
 	            { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.fundingAccount, isSigner: true, isWritable: true },
+	            { pubkey: ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false },
 	        ];
 	        if (params.depositAuthority) {
 	            keys.push({
@@ -23038,13 +23039,11 @@ var solanaStakePool = (function (exports, node_buffer) {
 	    const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
 	    const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
 	    const stakePool = stakePoolAccount.account.data;
-	    // stakePool.tokenProgramId
 	    const instructions = [];
-	    // Create token account if not specified
+	    // The program handles ATA creation internally using funds from the user's deposit
+	    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
 	    if (!destinationTokenAccount) {
-	        const associatedAddress = getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
-	        instructions.push(createAssociatedTokenAccountIdempotentInstruction(payer !== null && payer !== void 0 ? payer : signerOrSession, associatedAddress, userPubkey, stakePool.poolMint));
-	        destinationTokenAccount = associatedAddress;
+	        destinationTokenAccount = getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
 	    }
 	    const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
 	    const [programSigner] = PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
@@ -23345,14 +23344,7 @@ var solanaStakePool = (function (exports, node_buffer) {
 	    const userWsolAccount = getAssociatedTokenAddressSync(NATIVE_MINT, userPubkey);
 	    const instructions = [];
 	    const signers = [];
-	    // instructions.push(
-	    //   createAssociatedTokenAccountIdempotentInstruction(
-	    //     signerOrSession,
-	    //     userWsolAccount,
-	    //     userPubkey,
-	    //     NATIVE_MINT,
-	    //   ),
-	    // )
+	    instructions.push(createAssociatedTokenAccountIdempotentInstruction(signerOrSession, userWsolAccount, userPubkey, NATIVE_MINT));
 	    const [programSigner] = PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
 	    const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
 	    instructions.push(StakePoolInstruction.withdrawWsolWithSession({