pub unsafe fn invoke_signed_unchecked(
instruction: &InstructionView<'_, '_, '_, '_>,
accounts: &[CpiAccount<'_>],
signers_seeds: &[Signer<'_, '_>],
) -> ProgramResultExpand description
Invoke a signed CPI without borrow validation.
Same as invoke_unchecked but also passes PDA signer seeds so
the callee can accept writes that would otherwise require a
signature.
§Safety
All of invoke_unchecked’s invariants apply, plus two more for
the signer-seeds path:
- Signer seeds must derive the claimed PDA. For every
Signerinsigners_seeds, the derived address (sha256 ofseeds || program_id || PDA_MARKER) must equal an address inaccountsthat is marked as signer. A mismatch will cause the runtime to reject the CPI, but the caller is expected to have verified this before reaching the Tier C path. - Seed lifetime.
signers_seeds(and every&[u8]it points at) must outlive the call. Temporary seed slices built inside a function frame are fine; seeds referencing dropped storage are not.
For the happy path the caller should hold a CpiValidator or
equivalent proof-object constructed by the checked path and let
that drive both this function’s inputs and the aliasing discipline
required above.