@ignitionfi/spl-stake-pool 1.1.19 → 1.1.20

package/dist/index.browser.esm.js

@@ -1530,6 +1530,7 @@ class StakePoolInstruction {
      * Creates a transaction instruction to withdraw WSOL from a stake pool using a session.
      */
     static withdrawWsolWithSession(params) {
+        var _a;
         const type = STAKE_POOL_INSTRUCTION_LAYOUTS.WithdrawWsolWithSession;
         const data = encodeData(type, {
             poolTokensIn: params.poolTokensIn,
@@ -1550,6 +1551,9 @@ class StakePoolInstruction {
             { pubkey: params.tokenProgramId, isSigner: false, isWritable: false },
             { pubkey: params.wsolMint, isSigner: false, isWritable: false },
             { pubkey: params.programSigner, isSigner: false, isWritable: true },
+            { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.userTransferAuthority, isSigner: true, isWritable: true },
+            { pubkey: params.userWallet, isSigner: false, isWritable: false },
+            { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
         ];
         if (params.solWithdrawAuthority) {
             keys.push({
@@ -1558,6 +1562,8 @@ class StakePoolInstruction {
                 isWritable: false,
             });
         }
+        // Associated Token Program must be last - only needed in transaction for CPI routing
+        keys.push({ pubkey: ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false });
         return new TransactionInstruction({
             programId: params.programId,
             keys,
@@ -2131,7 +2137,7 @@ async function withdrawSol(connection, stakePoolAddress, tokenOwner, solReceiver
 /**
  * Creates instructions required to withdraw wSOL from a stake pool.
  */
-async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSession, userPubkey, amount, minimumLamportsOut = 0, solWithdrawAuthority) {
+async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSession, userPubkey, amount, minimumLamportsOut = 0, solWithdrawAuthority, payer) {
     const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
     const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
     const stakePool = stakePoolAccount.account.data;
@@ -2145,7 +2151,8 @@ async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSes
     const userWsolAccount = getAssociatedTokenAddressSync(NATIVE_MINT, userPubkey);
     const instructions = [];
     const signers = [];
-    instructions.push(createAssociatedTokenAccountIdempotentInstruction(signerOrSession, userWsolAccount, userPubkey, NATIVE_MINT));
+    // The program handles wSOL ATA creation internally
+    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
     const [programSigner] = PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     instructions.push(StakePoolInstruction.withdrawWsolWithSession({
@@ -2162,6 +2169,8 @@ async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSes
         solWithdrawAuthority,
         wsolMint: NATIVE_MINT,
         programSigner,
+        userWallet: userPubkey,
+        payer,
         poolTokensIn: poolTokens,
         minimumLamportsOut,
     }));