This repository was archived by the owner on Jan 22, 2025. It is now read-only.
Amend transactions v2 proposal with dependent accounts #17901
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -143,10 +143,9 @@ pub struct MessageV2 { | |
| // unchanged | ||
| pub recent_blockhash: Hash, | ||
|
|
||
| /// Optimize instructions by separating dependent accounts from inputs | ||
| #[serde(with = "short_vec")] | ||
| pub instructions: Vec<CompiledInstructionV2>, | ||
| } | ||
|
|
||
| #[derive(Serialize, Deserialize)] | ||
|
|
@@ -158,15 +157,51 @@ pub struct AddressMap { | |
| #[serde(with = "short_vec")] | ||
| pub entries: Vec<u8>, | ||
| } | ||
|
|
||
| #[derive(Serialize, Deserialize)] | ||
| pub struct CompiledInstructionV2 { | ||
| /// unchanged | ||
| pub program_id_index: u8, | ||
|
|
||
| /// unchanged | ||
| #[serde(with = "short_vec")] | ||
| pub accounts: Vec<u8>, | ||
|
|
||
| /// Only programs in this list may be invoked by the outer instruction | ||
| #[serde(with = "short_vec")] | ||
| pub inner_programs: Vec<u8>, | ||
|
|
||
| /// Dependent accounts do not need to be mapped to the memory of the outer | ||
| /// instruction's execution context. They are available for passing to inner | ||
| /// instructions | ||
| #[serde(with = "short_vec")] | ||
| pub inner_program_accounts: Vec<u8>, | ||
|
|
||
| /// unchanged | ||
| #[serde(with = "short_vec")] | ||
| pub data: Vec<u8>, | ||
| } | ||
| ``` | ||
|
|
||
| #### Dependent accounts | ||
|
|
||
| The new transaction format supports lists of programs and accounts that a | ||
| transaction instruction may use when invoking inner instructions. These programs | ||
| and accounts are separate from transaction instruction account inputs so that | ||
| they do not need to incur the cost of serializing into the outer instruction's | ||
| memory which does need to read or write the account. | ||
|
|
||
| For extra user protection, only the programs listed in `inner_programs` may be | ||
| invoked by the outer transaction instruction. | ||
|
Comment on lines
+194
to
+195
Contributor
There was a problem hiding this comment. is this strict requirement? is there any concrete threat in mind? if that's the case, I'll try to address this at #17796 as well.
Contributor
Author
There was a problem hiding this comment. I think I already outlined a general threat here: #17901 (comment) but more concretely: If a user inadvertently calls a compromised or otherwise malicious program in their transaction, sandboxing can help limit what damage may be done. Transactions can restrict which programs are called and which signers can be used in an instruction to avoid a program being able to invoke a system or token program CPI with a signer account. |
||
|
|
||
| #### Size changes | ||
|
|
||
| - 1 byte for `prefix` field | ||
| - 1 byte for version enum discriminant | ||
| - 1 byte for `address_maps` length | ||
| - Each map requires 2 bytes for `entries` length and `num_readonly` | ||
| - Each map entry is 1 byte (u8) | ||
| - Each instruction requires 2 bytes for the lengths of `inner_programs` and `inner_program_accounts` | ||
|
|
||
| #### Cost changes | ||
|
|
||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we can avoid this additional churn to solve the problem described in this pr's description by providing yet another pathway (#17796 ) to access to tx's accounts in addition to the entrypoint one.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This can serve two purposes. One is avoiding the serialization overhead. The other (not mentioned in the PR description) is a stronger framework for isolating the scope of what an instruction can do. If we allow an instruction to dynamically load any account from the transaction, a malicious program might have enough resources for more damage. Imagine for instance, a program dynamically loads the fee payer signer account.