@ignitionfi/spl-stake-pool 1.1.15 → 1.1.17

package/dist/instructions.d.ts

@@ -288,6 +288,7 @@ export declare class StakePoolInstruction {
         tokenProgramId: PublicKey;
         programId: PublicKey;
         payer?: PublicKey;
+        userWallet: PublicKey;
         lamportsIn: number;
         minimumPoolTokensOut: number;
     }): TransactionInstruction;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ignitionfi/spl-stake-pool",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "description": "Ignition Stake Pool SDK for FOGO",
   "contributors": [
     "Anza Maintainers <maintainers@anza.xyz>",

package/src/index.ts

@@ -323,25 +323,15 @@ export async function depositWsolWithSession(
   const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint)
   const stakePool = stakePoolAccount.account.data
 
-  // stakePool.tokenProgramId
-
   const instructions: TransactionInstruction[] = []
 
-  // Create token account if not specified
+  // The program handles ATA creation internally using funds from the user's deposit
+  // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
   if (!destinationTokenAccount) {
-    const associatedAddress = getAssociatedTokenAddressSync(
+    destinationTokenAccount = getAssociatedTokenAddressSync(
       stakePool.poolMint,
       userPubkey,
     )
-    instructions.push(
-      createAssociatedTokenAccountIdempotentInstruction(
-        payer ?? signerOrSession,
-        associatedAddress,
-        userPubkey,
-        stakePool.poolMint,
-      ),
-    )
-    destinationTokenAccount = associatedAddress
   }
 
   const withdrawAuthority = await findWithdrawAuthorityProgramAddress(
@@ -379,6 +369,7 @@ export async function depositWsolWithSession(
       tokenProgramId: stakePool.tokenProgramId,
       programSigner,
       payer,
+      userWallet: userPubkey,
     }),
   )
   return {

package/src/instructions.ts

@@ -965,6 +965,7 @@ export class StakePoolInstruction {
     tokenProgramId: PublicKey
     programId: PublicKey
     payer?: PublicKey
+    userWallet: PublicKey
     lamportsIn: number
     minimumPoolTokensOut: number
   }): TransactionInstruction {
@@ -992,6 +993,7 @@ export class StakePoolInstruction {
       { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
       { pubkey: params.programSigner, isSigner: false, isWritable: true },
       { pubkey: params.payer ?? params.fundingAccount, isSigner: true, isWritable: true },
+      { pubkey: params.userWallet, isSigner: false, isWritable: false },
     ]
 
     if (params.depositAuthority) {