CPI Depth Attack
Security · Bottom
An exploit vector that abuses Solana's maximum CPI depth limit of 4 nested invocations to cause unexpected behavior in programs that do not account for call depth exhaustion. An attacker constructs a chain of CPI calls (A -> B -> C -> D) such that the target program at depth 3 or 4 cannot make its own expected CPI call (e.g., to the Token Program), causing it to fail in a state where partial mutations have already occurred. Defense requires either checking the remaining CPI depth before critical operations or designing instruction logic to be atomic regardless of CPI failure at any point.