@ignitionfi/spl-stake-pool 1.1.19 → 1.1.20

package/dist/instructions.d.ts

@@ -155,11 +155,13 @@ export type WithdrawWsolWithSessionParams = {
     managerFeeAccount: PublicKey;
     poolMint: PublicKey;
     tokenProgramId: PublicKey;
-    solWithdrawAuthority?: PublicKey;
     wsolMint: PublicKey;
     programSigner: PublicKey;
+    userWallet: PublicKey;
     poolTokensIn: number;
     minimumLamportsOut: number;
+    payer?: PublicKey;
+    solWithdrawAuthority?: PublicKey;
 };
 /**
  * Deposit SOL directly into the pool's reserve account. The output is a "pool" token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ignitionfi/spl-stake-pool",
-  "version": "1.1.19",
+  "version": "1.1.20",
   "description": "Ignition Stake Pool SDK for FOGO",
   "contributors": [
     "Anza Maintainers <maintainers@anza.xyz>",

package/src/index.ts

@@ -827,6 +827,7 @@ export async function withdrawWsolWithSession(
   amount: number,
   minimumLamportsOut: number = 0,
   solWithdrawAuthority?: PublicKey,
+  payer?: PublicKey,
 ) {
   const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress)
   const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint)
@@ -848,14 +849,8 @@ export async function withdrawWsolWithSession(
   const instructions: TransactionInstruction[] = []
   const signers: Signer[] = []
 
-  instructions.push(
-    createAssociatedTokenAccountIdempotentInstruction(
-      signerOrSession,
-      userWsolAccount,
-      userPubkey,
-      NATIVE_MINT,
-    ),
-  )
+  // The program handles wSOL ATA creation internally
+  // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
 
   const [programSigner] = PublicKey.findProgramAddressSync(
     [Buffer.from('fogo_session_program_signer')],
@@ -882,6 +877,8 @@ export async function withdrawWsolWithSession(
       solWithdrawAuthority,
       wsolMint: NATIVE_MINT,
       programSigner,
+      userWallet: userPubkey,
+      payer,
       poolTokensIn: poolTokens,
       minimumLamportsOut,
     }),

package/src/instructions.ts

@@ -382,11 +382,13 @@ export type WithdrawWsolWithSessionParams = {
   managerFeeAccount: PublicKey
   poolMint: PublicKey
   tokenProgramId: PublicKey
-  solWithdrawAuthority?: PublicKey
   wsolMint: PublicKey
   programSigner: PublicKey
+  userWallet: PublicKey
   poolTokensIn: number
   minimumLamportsOut: number
+  payer?: PublicKey
+  solWithdrawAuthority?: PublicKey
 }
 
 /**
@@ -1138,6 +1140,9 @@ export class StakePoolInstruction {
 
       { pubkey: params.wsolMint, isSigner: false, isWritable: false },
       { pubkey: params.programSigner, isSigner: false, isWritable: true },
+      { pubkey: params.payer ?? params.userTransferAuthority, isSigner: true, isWritable: true },
+      { pubkey: params.userWallet, isSigner: false, isWritable: false },
+      { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
     ]
 
     if (params.solWithdrawAuthority) {
@@ -1148,6 +1153,9 @@ export class StakePoolInstruction {
       })
     }
 
+    // Associated Token Program must be last - only needed in transaction for CPI routing
+    keys.push({ pubkey: ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false })
+
     return new TransactionInstruction({
       programId: params.programId,
       keys,