CPI Cross Program

Call other programs with CPI. Results appear in the same fence: same-line // comments when short, multiline // blocks below the sample when not.

invoke

CPI without PDA signer.

// invoke(&ix, &[from.clone(), to.clone(), system_program.clone()])?

invoke_signed

CPI where a PDA must sign.

// invoke_signed(&ix, accounts, signer_seeds)?

Account Infos

Pass AccountInfo slices matching instruction metas order.

// accounts: &[AccountInfo]

Privilege Extension

CPI cannot escalate privileges beyond caller.

// cannot mark writable if original ix lacked writable

CPI Depth

Runtime limits CPI call depth.

// keep CPI graphs shallow

Return Data

set_return_data / get_return_data for CPI results.

// sol_set_return_data(bytes)

System Transfer CPI

Transfer lamports via system program.

// system_instruction::transfer(&from, &to, lamports)

Token Transfer CPI

SPL token transfer CPI.

// spl_token::instruction::transfer(...)

Clone AccountInfo

AccountInfo is cloned cheaply (ref to shared state).

// account_info.clone()

Remaining Accounts

Extra accounts for flexible CPI targets.

// ctx.remaining_accounts

Program ID Check

Verify callee program id before CPI.

// require_keys_eq!(token_program.key(), spl_token::id())

Nested CPI

Callee may CPI further until depth limit.

// design for reentrancy safety

Error Propagation

CPI errors bubble as ProgramError.

// map_err into your error enum

Writable PDA

PDA must be writable in metas to mutate.

// AccountMeta::new(pda, false)

Signer Seeds Lifetime

Seeds slices must live for invoke_signed call.

// let seeds: &[&[u8]] = &[...]

Related

• PDAs and Seeds - PDA signers
• Transactions and Instructions - instruction building
• System and SPL Token - common CPI targets

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, Rust 1.91.1, and @solana/kit 7.0.0.