PDAs in Anchor

Program Derived Addresses have no private key; your program signs for them with seeds and bump via invoke_signed or CPI with_signer.

Recipe

#[account(
    seeds = [b"escrow", maker.key().as_ref()],
    bump,
)]
pub escrow: Account<'info, Escrow>,

When to reach for this: Program must custody assets or store canonical state at a deterministic address.

Working Example

use anchor_lang::prelude::*;
 
#[account]
#[derive(InitSpace)]
pub struct Escrow {
    pub maker: Pubkey,
    pub escrow_id: u64,
    pub bump: u8,
}
 
// `escrow_id` is an instruction argument, so the accounts struct must
// declare it with #[instruction(..)] before seeds can reference it.
#[derive(Accounts)]
#[instruction(escrow_id: u64)]
pub struct InitEscrow<'info> {
    #[account(
        init,
        payer = maker,
        space = 8 + Escrow::INIT_SPACE,
        seeds = [b"escrow", maker.key().as_ref(), escrow_id.to_le_bytes().as_ref()],
        bump,
    )]
    pub escrow: Account<'info, Escrow>,
    #[account(mut)]
    pub maker: Signer<'info>,
    pub system_program: Program<'info, System>,
}
 
pub fn init_escrow(ctx: Context<InitEscrow>, escrow_id: u64) -> Result<()> {
    let escrow = &mut ctx.accounts.escrow;
    escrow.maker = ctx.accounts.maker.key();
    escrow.escrow_id = escrow_id;
    // Anchor does NOT persist the bump for you - write it yourself.
    escrow.bump = ctx.bumps.escrow;
    Ok(())
}

What this demonstrates:

• Seeds + program id determine PDA address
• bump finds canonical off-curve bump; ctx.bumps.escrow exposes it
• Escrow::INIT_SPACE only exists because of #[derive(InitSpace)]
• Seeds that reference an instruction argument need #[instruction(..)]
• Store bump in account for cheaper later checks
• PDAs cannot be Signer type

Deep Dive

Derivation

Pubkey::find_program_address(seeds, program_id) returns (address, bump). Anchor wraps this in constraints.

Program Signing

Only the program that owns the PDA seeds can sign unless using external program id in seeds (advanced).

Gotchas

• Off-curve bump not stored - Extra CU each CPI. Fix: Persist bump in state.
• Seed length limits - Max seed data constraints. Fix: Keep seeds compact.
• Using system-owned PDA pattern wrong - Assign to program after create. Fix: Use Anchor init on PDA.
• Client/server seed mismatch - Transaction fails. Fix: Share seed builder in SDK.
• PDA as Signer<'info> - Compiles, then always fails at runtime: a PDA has no key to sign the transaction. Fix: Use Account with a seeds constraint and sign only inside CPIs.

Alternatives

FAQs

Related

• Signing with PDAs - CPI signing
• Seeds & Bump Constraints - validation
• PDA Basics - native model

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.