Reject faked stake/vote accounts in stake mgmt.

[ryoqun]

Problem

There is no account.owner check for referenced stake/vote accounts when delegating/splitting/merging stake accounts.

Because these referenced accounts are read-only, the runtime doesn't enforce the account.owner check. Users can pass any accounts of any owner as long as it deserializes into StakeState or VoteState, so we must check account.owner by ourselves.

This time I checked this trait for possible similar issues, but I found other uses of KeyedAccount without owner check is legitimate:

solana/programs/stake/src/stake_state.rs

Lines 53 to 106 in 6c5fb32

	impl StakeState {
	pub fn get_rent_exempt_reserve(rent: &Rent) -> u64 {
	rent.minimum_balance(std::mem::size_of::<StakeState>())
	}
	// utility function, used by Stakes, tests
	pub fn from(account: &Account) -> Option<StakeState> {
	account.state().ok()
	}
	pub fn stake_from(account: &Account) -> Option<Stake> {
	Self::from(account).and_then(|state: Self| state.stake())
	}
	pub fn stake(&self) -> Option<Stake> {
	match self {
	StakeState::Stake(_meta, stake) => Some(*stake),
	_ => None,
	}
	}
	pub fn delegation_from(account: &Account) -> Option<Delegation> {
	Self::from(account).and_then(|state: Self| state.delegation())
	}
	pub fn delegation(&self) -> Option<Delegation> {
	match self {
	StakeState::Stake(_meta, stake) => Some(stake.delegation),
	_ => None,
	}
	}
	pub fn authorized_from(account: &Account) -> Option<Authorized> {
	Self::from(account).and_then(|state: Self| state.authorized())
	}
	pub fn authorized(&self) -> Option<Authorized> {
	match self {
	StakeState::Stake(meta, _stake) => Some(meta.authorized),
	StakeState::Initialized(meta) => Some(meta.authorized),
	_ => None,
	}
	}
	pub fn lockup_from(account: &Account) -> Option<Lockup> {
	Self::from(account).and_then(|state: Self| state.lockup())
	}
	pub fn lockup(&self) -> Option<Lockup> {
	match self {
	StakeState::Stake(meta, _stake) => Some(meta.lockup),
	StakeState::Initialized(meta) => Some(meta.lockup),
	_ => None,
	}
	}
	}

Summary of Changes

Add guards and outright reject such transactions.

Also, this is feature-gated under stake_program_v2, implicitly.

Fixes #

[ryoqun]

@CriesofCarrots Could you review this before #13461 ?

@rwalker-com Hi, could you review this?

[CriesofCarrots]

Fix and process tests lgtm!
One nit to make stake_instruction test changes more clear.

[ryoqun]

@jackcmay just making sure; it seems that IncorrectProgramId isn't used much; but I think this is a perfect usecase of IncorrectProgramId for these kinds of checks, I guess.

[jackcmay]

The description of this error is doesn't make much sense but the way you propose to use it here makes as much sense as any ;-)

[CriesofCarrots]

Fwiw, this seems perfectly consistent with how the error is used in the Vest program

[ryoqun]

yeah, I copied from that. :)

Pull request has been modified.

[rwalker-com]

lgtm

[ryoqun]

@CriesofCarrots @rob-solana Thanks for reviewing! I'm going to merge this shortly after now. I'm doing last-minute local test this.

[ryoqun]

buildkite/solana/downstream-projects — Failed (exit status 101)

Merging this despite the quoted build failure; I'm aware this is already being addressed and the failure isn't related to this pr.