@ignitionfi/spl-stake-pool 1.1.19 → 1.1.20

package/dist/index.cjs.js

@@ -1551,6 +1551,7 @@ class StakePoolInstruction {
      * Creates a transaction instruction to withdraw WSOL from a stake pool using a session.
      */
     static withdrawWsolWithSession(params) {
+        var _a;
         const type = STAKE_POOL_INSTRUCTION_LAYOUTS.WithdrawWsolWithSession;
         const data = encodeData(type, {
             poolTokensIn: params.poolTokensIn,
@@ -1571,6 +1572,9 @@ class StakePoolInstruction {
             { pubkey: params.tokenProgramId, isSigner: false, isWritable: false },
             { pubkey: params.wsolMint, isSigner: false, isWritable: false },
             { pubkey: params.programSigner, isSigner: false, isWritable: true },
+            { pubkey: (_a = params.payer) !== null && _a !== void 0 ? _a : params.userTransferAuthority, isSigner: true, isWritable: true },
+            { pubkey: params.userWallet, isSigner: false, isWritable: false },
+            { pubkey: web3_js.SystemProgram.programId, isSigner: false, isWritable: false },
         ];
         if (params.solWithdrawAuthority) {
             keys.push({
@@ -1579,6 +1583,8 @@ class StakePoolInstruction {
                 isWritable: false,
             });
         }
+        // Associated Token Program must be last - only needed in transaction for CPI routing
+        keys.push({ pubkey: splToken.ASSOCIATED_TOKEN_PROGRAM_ID, isSigner: false, isWritable: false });
         return new web3_js.TransactionInstruction({
             programId: params.programId,
             keys,
@@ -2152,7 +2158,7 @@ async function withdrawSol(connection, stakePoolAddress, tokenOwner, solReceiver
 /**
  * Creates instructions required to withdraw wSOL from a stake pool.
  */
-async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSession, userPubkey, amount, minimumLamportsOut = 0, solWithdrawAuthority) {
+async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSession, userPubkey, amount, minimumLamportsOut = 0, solWithdrawAuthority, payer) {
     const stakePoolAccount = await getStakePoolAccount(connection, stakePoolAddress);
     const stakePoolProgramId = getStakePoolProgramId(connection.rpcEndpoint);
     const stakePool = stakePoolAccount.account.data;
@@ -2166,7 +2172,8 @@ async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSes
     const userWsolAccount = splToken.getAssociatedTokenAddressSync(splToken.NATIVE_MINT, userPubkey);
     const instructions = [];
     const signers = [];
-    instructions.push(splToken.createAssociatedTokenAccountIdempotentInstruction(signerOrSession, userWsolAccount, userPubkey, splToken.NATIVE_MINT));
+    // The program handles wSOL ATA creation internally
+    // This prevents rent drain attacks where paymaster pays for ATA and user reclaims rent
     const [programSigner] = web3_js.PublicKey.findProgramAddressSync([Buffer.from('fogo_session_program_signer')], stakePoolProgramId);
     const withdrawAuthority = await findWithdrawAuthorityProgramAddress(stakePoolProgramId, stakePoolAddress);
     instructions.push(StakePoolInstruction.withdrawWsolWithSession({
@@ -2183,6 +2190,8 @@ async function withdrawWsolWithSession(connection, stakePoolAddress, signerOrSes
         solWithdrawAuthority,
         wsolMint: splToken.NATIVE_MINT,
         programSigner,
+        userWallet: userPubkey,
+        payer,
         poolTokensIn: poolTokens,
         minimumLamportsOut,
     }));