@ignitionfi/spl-stake-pool 1.1.15 → 1.1.16

package/dist/index.browser.cjs.js

@@ -1468,6 +1468,7 @@ class StakePoolInstruction {
             { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
             { pubkey: params.programSigner, isSigner: false, isWritable: true },
             { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.fundingAccount, isSigner: true, isWritable: true },
+            { pubkey: splToken.ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false },
         ];
         if (params.depositAuthority) {
             keys.push({
@@ -1857,13 +1858,11 @@ async function depositWsolWithSession(connection, stakePoolAddress, signerOrSess
     const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
     const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
     const stakePool = stakePoolAccount.account.data;
-    // stakePool.tokenProgramId
     const instructions = [];
-    // Create token account if not specified
+    // The program handles ATA creation internally using funds from the user's deposit
+    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
     if (!destinationTokenAccount) {
-        const associatedAddress = splToken.getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
-        instructions.push(splToken.createAssociatedTokenAccountIdempotentInstruction(payer !== null && payer !== void 0 ? payer : signerOrSession, associatedAddress, userPubkey, stakePool.poolMint));
-        destinationTokenAccount = associatedAddress;
+        destinationTokenAccount = splToken.getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
     }
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     const [programSigner] = web3_js.PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);