pub struct HopperInstructionPolicy {
pub unsafe_memory: bool,
pub skip_token_checks: bool,
pub allow_arbitrary_cpi: bool,
pub ctx_args: u8,
}Expand description
Per-instruction policy override.
The #[instruction(N, unsafe_memory, skip_token_checks, allow_arbitrary_cpi, ctx_args = K)]
attribute emits pub const <HANDLER>_POLICY: HopperInstructionPolicy = ...;
alongside the handler. All fields default to the inherit-from-program
behaviour (false / 0) so handlers without overrides get the program
policy unchanged.
Fields§
§unsafe_memory: boolOpt this handler out of #[deny(unsafe_code)] even when the
program-level allow_unsafe is false. Used for the one or two
“fast path” handlers in an otherwise-sealed program.
skip_token_checks: boolDeclare an exception to the program-level token-check intent. This does not remove checks from helper calls; authors document how the handler upholds its token invariants.
allow_arbitrary_cpi: boolMarks a handler as intentionally able to invoke arbitrary external programs, for governance/proposal executors and plugin dispatchers. Hopper does not forbid this path; the flag makes the capability visible to generated schema, review tools, and audit-oriented explain output.
ctx_args: u8Count of leading instruction args the dispatcher threads to the
typed context’s bind_with_args(...). 0 means the context
(if any) is bound via bind(ctx)? and no args participate in
constraint evaluation. which is the legacy shape and matches
Anchor’s non-#[instruction] accounts struct. When a context
was declared with #[instruction(name: Type, ...)], the handler
must set ctx_args equal to the number of declared args. Generated
code also pins identical names and order, so every seed, constraint,
and exact-cell selector resolves to the same wire value off chain and
on chain.