refactor(sdk): enforce payer to only interact with own if stake and user stats (#1709)

Author: ChesterSim

sdk/src/driftClient.ts

@@ -1075,7 +1075,10 @@ export class DriftClient {
 	async getInitializeUserStatsIx(): Promise<TransactionInstruction> {
 		return await this.program.instruction.initializeUserStats({
 			accounts: {
-				userStats: this.getUserStatsAccountPublicKey(),
+				userStats: getUserStatsAccountPublicKey(
+					this.program.programId,
+					this.wallet.publicKey // only allow payer to initialize own user stats account
+				),
 				authority: this.wallet.publicKey,
 				payer: this.wallet.publicKey,
 				rent: anchor.web3.SYSVAR_RENT_PUBKEY,
@@ -8377,19 +8380,24 @@ export class DriftClient {
 			marketIndex
 		);
 
+		const accounts = {
+			insuranceFundStake: ifStakeAccountPublicKey,
+			spotMarket: this.getSpotMarketAccount(marketIndex).pubkey,
+			userStats: getUserStatsAccountPublicKey(
+				this.program.programId,
+				this.wallet.publicKey // only allow payer to initialize own insurance fund stake account
+			),
+			authority: this.wallet.publicKey,
+			payer: this.wallet.publicKey,
+			rent: anchor.web3.SYSVAR_RENT_PUBKEY,
+			systemProgram: anchor.web3.SystemProgram.programId,
+			state: await this.getStatePublicKey(),
+		};
+
 		return await this.program.instruction.initializeInsuranceFundStake(
 			marketIndex,
 			{
-				accounts: {
-					insuranceFundStake: ifStakeAccountPublicKey,
-					spotMarket: this.getSpotMarketAccount(marketIndex).pubkey,
-					userStats: this.getUserStatsAccountPublicKey(),
-					authority: this.wallet.publicKey,
-					payer: this.wallet.publicKey,
-					rent: anchor.web3.SYSVAR_RENT_PUBKEY,
-					systemProgram: anchor.web3.SystemProgram.programId,
-					state: await this.getStatePublicKey(),
-				},
+				accounts,
 			}
 		);
 	}
@@ -8417,7 +8425,10 @@ export class DriftClient {
 					state: await this.getStatePublicKey(),
 					spotMarket: spotMarket.pubkey,
 					insuranceFundStake: ifStakeAccountPublicKey,
-					userStats: this.getUserStatsAccountPublicKey(),
+					userStats: getUserStatsAccountPublicKey(
+						this.program.programId,
+						this.wallet.publicKey // only allow payer to add to own insurance fund stake account
+					),
 					authority: this.wallet.publicKey,
 					spotMarketVault: spotMarket.vault,
 					insuranceFundVault: spotMarket.insuranceFund.vault,
@@ -8539,7 +8550,12 @@ export class DriftClient {
 		let tokenAccount;
 
 		if (
-			!(await this.checkIfAccountExists(this.getUserStatsAccountPublicKey()))
+			!(await this.checkIfAccountExists(
+				getUserStatsAccountPublicKey(
+					this.program.programId,
+					this.wallet.publicKey // only allow payer to initialize own user stats account
+				)
+			))
 		) {
 			addIfStakeIxs.push(await this.getInitializeUserStatsIx());
 		}