Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>BPF Stake Program>Threat Model>Instruction: MoveLamports
GeneralOverview
DiscussionTest suite
Threat ModelWhat are threat models?
solana-stake-programInstruction: AuthorizeCheckedWithSeedInstruction: AuthorizeCheckedInstruction: AuthorizeWithSeedInstruction: AuthorizeInstruction: DeactivateDelinquentInstruction: DeactivateInstruction: DelegateStakeInstruction: GetMinimumDelegationInstruction: InitializeCheckedInstruction: InitializeInstruction: MergeInstruction: MoveLamportsInstruction: MoveStakeInstruction: RedelegateInstruction: SetLockupCheckedInstruction: SetLockupInstruction: SplitInstruction: Withdraw
Audit ResultsAssessment Results

Instruction: MoveLamports

This instruction moves unstaked lamports between accounts with the same authorities and lockups, using the staker authority.

Input structure

pub enum StakeInstruction { /// # Account references /// 0. `[WRITE]` Active or inactive source stake account /// 1. `[WRITE]` Mergeable destination stake account /// 2. `[SIGNER]` Stake authority /// /// The u64 is the portion of available lamports to move MoveLamports(u64), } fn process_move_lamports(accounts: &[AccountInfo], lamports: u64) -> ProgramResult {

Parameters

  • lamports: The amount of unstaked lamports to move.

Accounts

  • source_stake_account: The source stake account to move unstaked lamports from.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: The address must be different from the destination stake account.

  • destination_stake_account: The destination stake account to move unstaked lamports to.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: The address must be different from the source stake account.

  • stake_authority: The stake authority account who is authorized to manage the stake account.

    • Signer: Yes.

    • Init: No.

    • PDA: No.

    • Writable: No.

    • Rent checks: None.

    • Ownership checks: None.

    • Address checks: None.

Additional checks and behavior

  • The withdrawal amount must not be equal to zero.

  • The stake accounts must be in the Stake or Initialized state.

  • The stake accounts must not be in a transient state, such as activating or deactivating with nonzero effective stake.

  • The staker of the source stake account must be the signer.

  • The lockups of the source and destination stake accounts must match if they are in force.

  • The authorities of the source and destination stake accounts must match.

  • The free lamports of the source stake account must be greater than or equal to the amount to move.

  • The lamports are moved from the source stake account to the destination stake account.

Zellic © 2025Back to top ↑