@ignitionfi/spl-stake-pool 1.1.15 → 1.1.17

package/dist/index.browser.esm.js

@@ -1447,6 +1447,7 @@ class StakePoolInstruction {
             { pubkey: params.wsolTransientAccount, isSigner: false, isWritable: true },
             { pubkey: params.programSigner, isSigner: false, isWritable: true },
             { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.fundingAccount, isSigner: true, isWritable: true },
+            { pubkey: params.userWallet, isSigner: false, isWritable: false },
         ];
         if (params.depositAuthority) {
             keys.push({
@@ -1836,13 +1837,11 @@ async function depositWsolWithSession(connection, stakePoolAddress, signerOrSess
     const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
     const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
     const stakePool = stakePoolAccount.account.data;
-    // stakePool.tokenProgramId
     const instructions = [];
-    // Create token account if not specified
+    // The program handles ATA creation internally using funds from the user's deposit
+    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
     if (!destinationTokenAccount) {
-        const associatedAddress = getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
-        instructions.push(createAssociatedTokenAccountIdempotentInstruction(payer !== null && payer !== void 0 ? payer : signerOrSession, associatedAddress, userPubkey, stakePool.poolMint));
-        destinationTokenAccount = associatedAddress;
+        destinationTokenAccount = getAssociatedTokenAddressSync(stakePool.poolMint, userPubkey);
     }
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     const [programSigner] = PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
@@ -1866,6 +1865,7 @@ async function depositWsolWithSession(connection, stakePoolAddress, signerOrSess
         tokenProgramId: stakePool.tokenProgramId,
         programSigner,
         payer,
+        userWallet: userPubkey,
     }));
     return {
         instructions,