PDAs as Authorities

PDAs commonly act as mint authorities, freeze authorities, vault owners, and escrow custodians. The program enforces when the PDA may sign via business logic.

Recipe

// Mint authority PDA seeds: [b"mint_auth", mint.key.as_ref()]

When to reach for this:

• Launching tokens with program-controlled mint.
• Holding user funds in escrow until conditions met.
• Treasury accounts for protocol fees.

Working Example

// Conceptual: program verifies escrow conditions then signs token transfer from escrow PDA
pub fn release_escrow(bump: u8, /* accounts */) -> ProgramResult {
    // validate expiry, signatures, state machine
    // transfer_checked CPI with invoke_signed seeds &[&[b"escrow", &[bump]]]
    // (spl_token::instruction::transfer is deprecated and rejects Token-2022)
    Ok(())
}

What this demonstrates:

• Business rules gate PDA signature.
• Escrow PDA holds SPL tokens.
• State machine checked before CPI.

Deep Dive

Patterns

Risk

Program bug = full authority compromise.

Rust Notes

// Never expose arbitrary invoke_signed wrapper without checks.

Gotchas

• Arbitrary CPI wrapper - Anyone triggers PDA sign. Fix: Bind to instruction handlers.
• Escrow without expiry - Funds locked forever. Fix: Time or cancel paths.
• Shared authority PDA - One breach hits all users. Fix: Per-user seed isolation.
• Mint authority not revoked - Infinite mint risk. Fix: Revoke after setup.
• Token account owner mismatch - PDA must own token account. Fix: Validate ATA.

Alternatives

FAQs

Related

• Vault & Escrow - Patterns
• CPI to SPL Token - Token ops
• Access Control & Authorities - Roles

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.

383k393a3c3q3e393a3o1r3e3k3x383c3e3k1v1z223x1v1t1v1z1t20