Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>BPF Stake Program>Threat Model>Instruction: AuthorizeWithSeed
GeneralOverview
DiscussionTest suite
Threat ModelWhat are threat models?
solana-stake-programInstruction: AuthorizeCheckedWithSeedInstruction: AuthorizeCheckedInstruction: AuthorizeWithSeedInstruction: AuthorizeInstruction: DeactivateDelinquentInstruction: DeactivateInstruction: DelegateStakeInstruction: GetMinimumDelegationInstruction: InitializeCheckedInstruction: InitializeInstruction: MergeInstruction: MoveLamportsInstruction: MoveStakeInstruction: RedelegateInstruction: SetLockupCheckedInstruction: SetLockupInstruction: SplitInstruction: Withdraw
Audit ResultsAssessment Results

Instruction: AuthorizeWithSeed

This instruction updates the stake or withdraw authority of a stake account who manages stake or withdrawal. The stake or withdraw authority must be a signer to use an account derived from the seed as a signer.

Input structure

pub struct AuthorizeWithSeedArgs { pub new_authorized_pubkey: Pubkey, pub stake_authorize: StakeAuthorize, pub authority_seed: String, pub authority_owner: Pubkey, } pub enum StakeInstruction { /// # Account references /// 0. `[WRITE]` Stake account to be updated /// 1. `[SIGNER]` Base key of stake or withdraw authority /// 2. `[]` Clock sysvar /// 3. Optional: `[SIGNER]` Lockup authority, if updating StakeAuthorize::Withdrawer before /// lockup expiration AuthorizeWithSeed(AuthorizeWithSeedArgs), } fn process_authorize_with_seed( accounts: &[AccountInfo], authorize_args: AuthorizeWithSeedArgs, ) -> ProgramResult {

Parameters

  • new_authorized_pubkey: The new authority to update.

  • stake_authorize: The type of authority to update.

  • authority_seed: The seed for the derived address.

  • authority_owner: The owner of the derived address.

Accounts

  • stake_account: The stake account to be updated.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: None.

  • clock: The account must be a clock sysvar.

  • stake_or_withdraw_authority_base: The base key of the stake or withdraw authority.

    • Signer: Yes.

    • Init: No.

    • PDA: No.

    • Writable: No.

    • Rent checks: None.

    • Ownership checks: None.

    • Address checks: None.

  • option_lockup_authority (optional): The lockup authority account, if updating StakeAuthorize::Withdrawer before lockup expiration.

    • Signer: Yes.

    • Init: No.

    • PDA: No.

    • Writable: No.

    • Rent checks: None.

    • Ownership checks: None.

    • Address checks: None.

Additional checks and behavior

  • lockup_authority must be a signer if provided.

  • stake_or_withdraw_authority_base must be a signer so that the account derived from the seed becomes a signer.

  • When updating the staker, either the current staker or the withdrawer of the stake account must be a signer.

  • When updating the withdrawer, the current withdrawer of the stake account must be a signer.

  • When updating the withdrawer, the lockup must not be in force or the custodian must be a signer.

  • The stake account authority is updated with the provided new_authorized key.

Zellic © 2025Back to top ↑