Assessment reports>Single Pool>Threat Model>Instruction: WithdrawStake

Instruction: WithdrawStake

This instruction can be used to redeem pool tokens in exchange for their corresponding shares of staked SOL. The amount of staked assets to be withdrawn is proportional to the amount of pool tokens being redeemed with respect to the total minted amount.

The program burns the given amount of pool tokens and splits off the computed amount of SOL into a new stake account; finally, it transfers control of the new stake account to an address specified by the user.

Inputs

  • user_stake_authority: User authority for the new stake account.

    • Validation: None.

  • token_amount: Amount of tokens to redeem for stake.

    • Validation: None explicitly — must be less than the amount owned by the user token account.

Input accounts

  • pool_info: Pool account.

    • W/S requisites: None.

    • Owner: Single pool program.

    • Rent: N/A.

    • Initialized: Yes.

    • Discriminant: Checked (account_type field).

    • PDA: Yes, controlled by the single pool program; using seeds "pool", vote_account_address; and checked by reading internal state.

  • pool_stake_info: Stake account associated with the pool.

    • W/S requisites: Writable.

    • Owner: Stake program (indirectly checked, since it is written to by the stake program).

    • Rent: N/A.

    • Initialized: Yes.

    • Discriminant: Checked.

    • PDA: Yes, controlled by the single pool program — using seeds "stake", pool_address.

  • pool_mint_info: Mint account associated with the pool.

    • W/S requisites: Writable.

    • Owner: Token program (indirectly checked, since it is written to by the token program).

    • Rent: N/A.

    • Initialized: Yes.

    • Discriminant: Not a responsibility of the program under review.

    • PDA: Yes, controlled by the single pool program — using seeds "mint", pool_address.

  • pool_stake_authority_info: Authority controlling the pool stake.

    • W/S requisites: None.

    • Owner: N/A.

    • Rent: N/A.

    • Initialized: N/A.

    • Discriminant: N/A.

    • PDA: Yes, controlled by the single pool program — using seeds "stake authority", pool_address.

  • pool_mint_authority_info: Authority controlling the pool mint.

    • W/S requisites: None.

    • Owner: N/A.

    • Rent: N/A.

    • Initialized: N/A.

    • Discriminant: N/A.

    • PDA: Yes, controlled by the single pool program — using seeds "mint authority", pool_address.

  • user_stake_info: Empty account that will be initialized as a stake account. It will receive the stake split off of the pool stake account.

    • W/S requisites: Writeable.

    • Owner: Stake program (indirectly checked, since it is written to by the stake program).

    • Rent: Not a responsibility of the program under review.

    • Initialized: No.

    • Discriminant: Not a responsibility of the program under review.

    • PDA: No. Address must be different than pool_stake_info.

  • user_token_account_info: User token account from where pool tokens are taken and burned from.

    • W/S requisites: Writable.

    • Owner: Token program (indirectly checked, since it is written to by the token program).

    • Rent: N/A.

    • Initialized: Yes.

    • Discriminant: Not a responsibility of the program under review.

    • PDA: No.

  • clock_info: Clock sysvar account — not used, only passed along to the stake program.

    • W/S requisites: None.

    • Owner: N/A (sysvar).

    • Rent: N/A (sysvar).

    • Initialized: N/A (sysvar).

    • Discriminant: N/A (sysvar).

    • PDA: No.

  • token_program_info: Token program account.

    • W/S requisites: None.

    • Owner: N/A (sysvar).

    • Rent: N/A (sysvar).

    • Initialized: N/A (sysvar).

    • Discriminant: N/A (sysvar).

    • PDA: No — the address is checked to ensure it matches the actual token program.

  • stake_program_info: Stake program account.

    • W/S requisites: None.

    • Owner: N/A (sysvar).

    • Rent: N/A (sysvar).

    • Initialized: N/A (sysvar).

    • Discriminant: N/A (sysvar).

    • PDA: No — the address is checked to ensure it matches the actual stake program.

Zellic © 2025Back to top ↑