Skip to main content

invoke_signed_unchecked

Function invoke_signed_unchecked 

Source
pub unsafe fn invoke_signed_unchecked(
    instruction: &InstructionView<'_, '_, '_, '_>,
    accounts: &[CpiAccount<'_>],
    signers_seeds: &[Signer<'_, '_>],
) -> ProgramResult
Expand description

Invoke a signed CPI without borrow validation.

Same as invoke_unchecked but also passes PDA signer seeds so the callee can accept writes that would otherwise require a signature.

§Safety

All of invoke_unchecked’s invariants apply, plus two more for the signer-seeds path:

  1. Signer seeds must derive the claimed PDA. For every Signer in signers_seeds, the derived address (sha256 of seeds || program_id || PDA_MARKER) must equal an address in accounts that is marked as signer. A mismatch will cause the runtime to reject the CPI, but the caller is expected to have verified this before reaching the Tier C path.
  2. Seed lifetime. signers_seeds (and every &[u8] it points at) must outlive the call. Temporary seed slices built inside a function frame are fine; seeds referencing dropped storage are not.

For the happy path the caller should hold a CpiValidator or equivalent proof-object constructed by the checked path and let that drive both this function’s inputs and the aliasing discipline required above.