Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>BPF Stake Program>Threat Model>Instruction: Merge
GeneralOverview
DiscussionTest suite
Threat ModelWhat are threat models?
solana-stake-programInstruction: AuthorizeCheckedWithSeedInstruction: AuthorizeCheckedInstruction: AuthorizeWithSeedInstruction: AuthorizeInstruction: DeactivateDelinquentInstruction: DeactivateInstruction: DelegateStakeInstruction: GetMinimumDelegationInstruction: InitializeCheckedInstruction: InitializeInstruction: MergeInstruction: MoveLamportsInstruction: MoveStakeInstruction: RedelegateInstruction: SetLockupCheckedInstruction: SetLockupInstruction: SplitInstruction: Withdraw
Audit ResultsAssessment Results

Instruction: Merge

This instruction splits tokens and stake off a stake account into a new stake account.

Input structure

pub enum StakeInstruction { /// # Account references /// 0. `[WRITE]` Destination stake account for the merge /// 1. `[WRITE]` Source stake account for to merge. This account will be drained /// 2. `[]` Clock sysvar /// 3. `[]` Stake history sysvar that carries stake warmup/cooldown history /// 4. `[SIGNER]` Stake authority Merge, }

Accounts

  • destination_stake_account: The destination stake account for the merge.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: The address must be different from the source stake account.

  • source_stake_account: The source stake account to merge that will be drained.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: The address must be different from the destination stake account.

  • clock: The account must be a clock sysvar.

  • stake_history_info: Unused.

  • stake_authority: The stake authority account who is authorized to manage the stake account.

    • Signer: Yes.

    • Init: No.

    • PDA: No.

    • Writable: No.

    • Rent checks: None.

    • Ownership checks: None.

    • Address checks: None.

Additional checks and behavior

  • The stake accounts must be in the Stake or Initialized state.

  • The stake accounts must not be in a transient state, such as activating or deactivating with nonzero effective stake.

  • The staker of the destination stake account must be the signer.

  • The lockups of the source and destination stake accounts must match if they are in force.

  • The authorities of the source and destination stake accounts must match.

  • The stake accounts must have the same voter pubkey.

  • Both stake accounts must not be scheduled for deactivation.

  • If either merge kind of stake accounts is inactive, the destination stake account must be activating.

  • If the destination stake account is activating and the source stake account is inactive, merge the source stake account into the destination stake account.

  • If both stake accounts are activating, merge the source stake account into the destination stake account with rent-exempt reserve and update the credits observed.

  • If both stake accounts are active, merge the source stake account into the destination stake account and update the credits observed.

  • The source stake account state is deinitialized.

  • All lamports are moved from the source stake account to the destination stake account.

Zellic © 2025Back to top ↑