Assessment reports>Pyth2Wormhole>Discussion>Extra check in attest

Extra check in attest

Function attest (from attest.rs) performs a redundant check.

The function expects as input an account structure of type Attest:

#[derive(FromAccounts, ToInstruction)]
pub struct Attest<'b> {
    // Payer also used for wormhole
    pub payer: Mut<Signer<Info<'b>>>,
    pub system_program: Info<'b>,
    pub config: P2WConfigAccount<'b, { AccountState::Initialized }>,
    // ... more fields

The config member is a type alias for solitaire Derive type:

pub type P2WConfigAccount<'b, const IsInitialized: AccountState> =
    Derive<Data<'b, Pyth2WormholeConfig, { IsInitialized }>, "pyth2wormhole-config">;`

At the beginning of the function a check is performed to ensure the config account public key is a program derived address (PDA).

pub fn attest(ctx: &ExecutionContext, accs: &mut Attest, data: AttestData) -> SoliResult<()> {
    accs.config.verify_derivation(ctx.program_id, None)?;
    // ...

This check is redundant, as the Peel trait for Derived already ensures that the account public key corresponds to the expected one.

Zellic © 2024Back to top ↑