SPL Token in Programs

On-chain programs interact with SPL Token via cross-program invocations (CPIs). Anchor 0.32.1 anchor-spl wraps account validation, deserialization, and instruction builders for production-grade token logic.

Recipe

use anchor_spl::token::{self, Mint, Token, TokenAccount, TransferChecked};
 
pub mint: Account<'info, Mint>,
#[account(mut, token::mint = mint, token::authority = authority)]
pub from: Account<'info, TokenAccount>,
pub token_program: Program<'info, Token>,
// ...
token::transfer_checked(cpi_ctx, amount, decimals)?;

When to reach for this:

• Escrow, vault, or payment programs moving SPL tokens
• Validating user ATAs in DeFi instructions
• Minting reward tokens from a PDA mint authority
• Enforcing mint match and signer rules on token CPIs

Working Example

use anchor_lang::prelude::*;
use anchor_spl::associated_token::AssociatedToken;
use anchor_spl::token::{self, Mint, Token, TokenAccount, TransferChecked};
 
#[derive(Accounts)]
pub struct Deposit<'info> {
    pub mint: Account<'info, Mint>,
    #[account(
        mut,
        associated_token::mint = mint,
        associated_token::authority = user,
        associated_token::token_program = token_program,
    )]
    pub user_ata: Account<'info, TokenAccount>,
    #[account(
        mut,
        token::mint = mint,
        token::authority = vault_authority,
    )]
    pub vault_ata: Account<'info, TokenAccount>,
    pub user: Signer<'info>,
    /// CHECK: PDA authority over vault ATA
    pub vault_authority: UncheckedAccount<'info>,
    pub token_program: Program<'info, Token>,
    pub associated_token_program: Program<'info, AssociatedToken>,
    pub system_program: Program<'info, System>,
}
 
pub fn deposit(ctx: Context<Deposit>, amount: u64) -> Result<()> {
    require!(amount > 0, ErrorCode::ZeroAmount);
    let decimals = ctx.accounts.mint.decimals;
    let cpi = CpiContext::new(
        ctx.accounts.token_program.to_account_info(),
        TransferChecked {
            mint: ctx.accounts.mint.to_account_info(),
            from: ctx.accounts.user_ata.to_account_info(),
            to: ctx.accounts.vault_ata.to_account_info(),
            authority: ctx.accounts.user.to_account_info(),
        },
    );
    token::transfer_checked(cpi, amount, decimals)?;
    Ok(())
}
 
#[error_code]
pub enum ErrorCode {
    ZeroAmount,
}

What this demonstrates:

• Account<'info, TokenAccount> validates owner is the classic Token program - it rejects Token-2022 accounts
• token::mint and associated_token constraints reduce manual pubkey checks
• transfer_checked includes decimals for safer asset handling; the unchecked Transfer is deprecated and Token-2022 rejects it on transfer-fee mints

Deep Dive

How It Works

• SPL Token program ID: TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA
• CPI passes serialized instruction + account metas to Token program
• Signer requirements: owner for debit, mint authority for mint_to, etc.
• anchor_spl::token_interface supports Token-2022 with TokenInterface type

Common CPI Instructions

Rust Notes

use anchor_lang::prelude::*;
use anchor_spl::token_interface::{Mint, TokenAccount, TokenInterface};
 
// Never mix the two module trees. `anchor_spl::token::{Mint, TokenAccount}` are
// classic-Token-only and their owner check rejects Token-2022 accounts; the
// token_interface types dispatch over both programs.
#[derive(Accounts)]
pub struct EitherProgram<'info> {
    pub mint: InterfaceAccount<'info, Mint>,
    #[account(mut, token::mint = mint)]
    pub from: InterfaceAccount<'info, TokenAccount>,
    pub token_program: Interface<'info, TokenInterface>,
}

Gotchas

• Missing mint equality check - vault ATA wrong asset. Fix: token::mint = mint constraint on all token accounts.
• UncheckedAccount as vault authority - no PDA seed validation. Fix: seeds + bump constraints on authority PDA.
• Wrong token_program account - Program<'info, Token> pins Tokenkeg..., and Account<'info, TokenAccount> rejects Token-2022-owned accounts, so there is no "just pass the Token-2022 program account" path. Fix: switch the whole account struct to anchor_spl::token_interface (InterfaceAccount + Interface<TokenInterface>), or in native Rust use spl_token_2022::instruction::* - spl_token::instruction::* calls check_program_account and returns IncorrectProgramId for any id but Tokenkeg....
• Mixing anchor_spl::token and anchor_spl::token_interface types - the classic types' owner check rejects extension mints. Fix: pick one module tree per account struct.
• PDA cannot sign transfer - missing with_signer seeds. Fix: CpiContext::new_with_signer with vault seeds.
• Extra CPI depth via Token-2022 hooks - a hooked mint adds a nested CPI to a separate hook program, costing depth and CU. A hook can never re-enter a program already on the stack (including yours or Token-2022 itself) - Solana rejects that with ReentrancyNotAllowed. Fix: budget CU and CPI depth; see transfer hook docs.

cGJxcnRodnFyZi52YnxwdHZiMjgwfDIwMjYwNw==

Alternatives

FAQs

Related

• Associated Token Accounts (ATAs) - ATA constraints
• Transfers & Delegates - delegate flows
• Cross-Program Invocations (CPI) - CPI fundamentals

Stack versions: This page was written for Agave 4.1.1, Solana CLI 3.0.10, Anchor 0.32.1, anchor-lang 0.32.1, Rust 1.91.1, @solana/kit 7.0.0, Surfpool 0.12.0, and LiteSVM 0.6.x.