Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>BPF Stake Program>Threat Model>Instruction: MoveStake
GeneralOverview
DiscussionTest suite
Threat ModelWhat are threat models?
solana-stake-programInstruction: AuthorizeCheckedWithSeedInstruction: AuthorizeCheckedInstruction: AuthorizeWithSeedInstruction: AuthorizeInstruction: DeactivateDelinquentInstruction: DeactivateInstruction: DelegateStakeInstruction: GetMinimumDelegationInstruction: InitializeCheckedInstruction: InitializeInstruction: MergeInstruction: MoveLamportsInstruction: MoveStakeInstruction: RedelegateInstruction: SetLockupCheckedInstruction: SetLockupInstruction: SplitInstruction: Withdraw
Audit ResultsAssessment Results

Instruction: MoveStake

This instruction moves stake between accounts with the same authorities and lockups, using the staker authority.

Input structure

pub enum StakeInstruction { /// # Account references /// 0. `[WRITE]` Active source stake account /// 1. `[WRITE]` Active or inactive destination stake account /// 2. `[SIGNER]` Stake authority /// /// The u64 is the portion of the stake to move, which may be the entire delegation MoveStake(u64), } fn process_move_stake(accounts: &[AccountInfo], lamports: u64) -> ProgramResult {

Parameters

  • lamports: The amount of stake to move.

Accounts

  • source_stake_account: The source stake account to move stake from.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: The address must be different from the destination stake account.

  • destination_stake_account: The destination stake account to move stake to.

    • Signer: No.

    • Init: No.

    • PDA: No.

    • Writable: Yes.

    • Rent checks: None.

    • Ownership checks: The account must be owned by the program.

    • Address checks: The address must be different from the source stake account.

  • stake_authority: The stake authority account who is authorized to manage the stake account.

    • Signer: Yes.

    • Init: No.

    • PDA: No.

    • Writable: No.

    • Rent checks: None.

    • Ownership checks: None.

    • Address checks: None.

Additional checks and behavior

  • The withdrawal amount must not be equal to zero.

  • The stake accounts must be in the Stake or Initialized state.

  • The stake accounts must not be in a transient state, such as activating or deactivating with nonzero effective stake.

  • The staker of the source stake account must be the signer.

  • The lockups of the source and destination stake accounts must match if they are in force.

  • The authorities of the source and destination stake accounts must match.

  • The size of source_stake_account and destination_stake_account must be equal to the size of StakeStateV2.

  • The destination merge kind must be fully active or inactive.

  • The source stake account must have enough stake to move.

  • The source stake account must retain at least the minimum delegation if not all stake is being moved.

  • If the destination stake account is active, the destination stake account must retain at least the minimum delegation.

  • If the destination stake account is inactive, lamports to move must not be less than the minimum delegation.

  • Stake and lamports are moved from the source stake account to the destination stake account.

  • An error is returned if the source or destination account balance is less than the rent-exempt reserve.

Zellic © 2025Back to top ↑