Prevent payer and init on the same constraint?

[Henry-E]

Very weird edge case, someone turned every user's wallet into a program account with this program. Essentially the payer pubkey and the claim_status account's pubkey were the same, and since the payer was signing they were able to convert that account to a program account.

Not really sure what the best way to prevent this would be. payer and init weren't actually used on the same account but the client passed them in as the same pubkey. There would have to be runtime check that the payer and the account being initialized weren't the same? Which of course you might want in certain scenarios, so it would have to be off by default and then enabled using some new constraint.

[omgbbqhaxx]

This is also my js codes : https://gist.github.com/omgbbqhaxx/d9e6b97eec38d2eacae78bb8c5292e5e

[Henry-E]

So one solution for this would be to check that the payer and [account_to_be_init] pubkeys are not the same and to error if this is the case. Then include a #[account( allow_same_payer = true )] inert attribute if it's desired for this functionality to be disabled.

[Henry-E]

Closed by #2284

[snawaz]

The docs do not seem to mention anything about the arguments that can be passed to #[account] , e.g init, user, payer.. etc. Where can I find the details of these arguments and how they should be used, what they actually mean.. and so on? The docs must be updated with these details!

[Henry-E]

https://docs.rs/anchor-lang/latest/anchor_lang/derive.Accounts.html

…

On Fri, Feb 10, 2023, 7:38 AM Sarfaraz Nawaz ***@***.***> wrote: The docs do not seem to mention anything about the arguments that can be passed to #[account] , e.g init, user, payer.. etc. Where can I find the details of these arguments and how they should be used, what they actually mean.. and so on? The docs must be updated with these details! — Reply to this email directly, view it on GitHub <#2222 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADAHMGG22GZMGH76O77Q23LWWXWABANCNFSM6AAAAAARDFBEVQ> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>